# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 15.01.2021 07:47:38.014 Process: id = "1" image_name = "hidden-tear.exe" filename = "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe" page_root = "0x14e6a000" os_pid = "0x13d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13dc [0041.886] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0042.564] RoInitialize () returned 0x1 [0042.564] RoUninitialize () returned 0x0 [0044.531] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e770 | out: phkResult=0x138e770*=0x0) returned 0x2 [0044.532] RegCloseKey (hKey=0x80000002) returned 0x0 [0044.542] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x138e9c8, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0044.751] IsAppThemed () returned 0x1 [0044.758] CoTaskMemAlloc (cb=0xf0) returned 0x1698d00 [0044.758] CreateActCtxA (pActCtx=0x138ef18) returned 0x16a66dc [0044.843] CoTaskMemFree (pv=0x1698d00) [0044.855] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0044.855] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc198 [0044.872] GetUserNameW (in: lpBuffer=0x138ed40, pcbBuffer=0x138efb8 | out: lpBuffer="FD1HVy", pcbBuffer=0x138efb8) returned 1 [0044.877] GetComputerNameW (in: lpBuffer=0x138ed40, nSize=0x138efb8 | out: lpBuffer="NQDPDE", nSize=0x138efb8) returned 1 [0045.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x138e818, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0045.708] GetCurrentProcess () returned 0xffffffff [0045.708] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138eb80 | out: TokenHandle=0x138eb80*=0x2cc) returned 1 [0045.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x138e60c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0045.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x138eb78 | out: lpFileInformation=0x138eb78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0045.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x138e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0045.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x138eb80 | out: lpFileInformation=0x138eb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0045.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x138e574, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0045.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138eab8) returned 1 [0045.716] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0045.716] GetFileType (hFile=0x2d0) returned 0x1 [0045.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138eab4) returned 1 [0045.716] GetFileType (hFile=0x2d0) returned 0x1 [0045.763] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x138eb74 | out: lpFileSizeHigh=0x138eb74*=0x0) returned 0x8c8f [0045.764] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138eb30, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138eb30*=0x1000, lpOverlapped=0x0) returned 1 [0045.778] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e9dc, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e9dc*=0x1000, lpOverlapped=0x0) returned 1 [0045.780] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e890, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e890*=0x1000, lpOverlapped=0x0) returned 1 [0045.781] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e890, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e890*=0x1000, lpOverlapped=0x0) returned 1 [0045.781] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e890, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e890*=0x1000, lpOverlapped=0x0) returned 1 [0045.781] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7c8, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e7c8*=0x1000, lpOverlapped=0x0) returned 1 [0045.786] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e94c, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e94c*=0x1000, lpOverlapped=0x0) returned 1 [0045.787] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e858, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e858*=0x1000, lpOverlapped=0x0) returned 1 [0045.788] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e858, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e858*=0xc8f, lpOverlapped=0x0) returned 1 [0045.788] ReadFile (in: hFile=0x2d0, lpBuffer=0x3259c14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e91c, lpOverlapped=0x0 | out: lpBuffer=0x3259c14*, lpNumberOfBytesRead=0x138e91c*=0x0, lpOverlapped=0x0) returned 1 [0045.788] CloseHandle (hObject=0x2d0) returned 1 [0045.789] GetCurrentProcess () returned 0xffffffff [0045.789] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138ecc8 | out: TokenHandle=0x138ecc8*=0x2d0) returned 1 [0045.790] GetCurrentProcess () returned 0xffffffff [0045.790] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138ecc8 | out: TokenHandle=0x138ecc8*=0x2d4) returned 1 [0045.790] GetCurrentProcess () returned 0xffffffff [0045.790] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138eb80 | out: TokenHandle=0x138eb80*=0x2d8) returned 1 [0045.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x138eb78 | out: lpFileInformation=0x138eb78*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0045.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x138e5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0045.791] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x138eb80 | out: lpFileInformation=0x138eb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0045.791] GetCurrentProcess () returned 0xffffffff [0045.791] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138ecc8 | out: TokenHandle=0x138ecc8*=0x2dc) returned 1 [0045.791] GetCurrentProcess () returned 0xffffffff [0045.791] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138ecc8 | out: TokenHandle=0x138ecc8*=0x2e0) returned 1 [0045.810] GetCurrentProcess () returned 0xffffffff [0045.810] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138eb28 | out: TokenHandle=0x138eb28*=0x2e4) returned 1 [0045.814] GetCurrentProcess () returned 0xffffffff [0045.814] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138eb38 | out: TokenHandle=0x138eb38*=0x2e8) returned 1 [0045.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0045.844] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0046.494] AdjustWindowRectEx (in: lpRect=0x138ef58, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0x138ef58) returned 1 [0046.496] GetCurrentProcess () returned 0xffffffff [0046.497] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x138ee6c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x138ee6c*=0x2f0) returned 1 [0046.504] GetCurrentActCtx (in: lphActCtx=0x138edcc | out: lphActCtx=0x138edcc*=0x0) returned 1 [0046.504] ActivateActCtx (in: hActCtx=0x16a66dc, lpCookie=0x138eddc | out: hActCtx=0x16a66dc, lpCookie=0x138eddc) returned 1 [0046.505] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0046.506] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0047.232] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0047.232] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0047.233] GetStockObject (i=5) returned 0x900015 [0047.235] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0047.238] CoTaskMemAlloc (cb=0x5a) returned 0x16a11d0 [0047.238] RegisterClassW (lpWndClass=0x138ec80) returned 0xc197 [0047.238] CoTaskMemFree (pv=0x16a11d0) [0047.239] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0047.239] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xfc0000, lpParam=0x0) returned 0x502ba [0047.241] SetWindowLongW (hWnd=0x502ba, nIndex=-4, dwNewLong=1950089536) returned 52561342 [0047.241] GetWindowLongW (hWnd=0x502ba, nIndex=-4) returned 1950089536 [0047.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e4a0 | out: phkResult=0x138e4a0*=0x308) returned 0x0 [0047.244] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x138e4c0, lpData=0x0, lpcbData=0x138e4bc*=0x0 | out: lpType=0x138e4c0*=0x0, lpData=0x0, lpcbData=0x138e4bc*=0x0) returned 0x2 [0047.244] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x138e4c0, lpData=0x0, lpcbData=0x138e4bc*=0x0 | out: lpType=0x138e4c0*=0x0, lpData=0x0, lpcbData=0x138e4bc*=0x0) returned 0x2 [0047.244] RegCloseKey (hKey=0x308) returned 0x0 [0047.245] SetWindowLongW (hWnd=0x502ba, nIndex=-4, dwNewLong=52561382) returned 1950089536 [0047.246] GetWindowLongW (hWnd=0x502ba, nIndex=-4) returned 52561382 [0047.246] GetWindowLongW (hWnd=0x502ba, nIndex=-16) returned 113311744 [0047.246] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19a [0047.248] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19b [0047.248] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502ba, Msg=0x81, wParam=0x0, lParam=0x138e7f0) returned 0x1 [0047.249] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502ba, Msg=0x83, wParam=0x0, lParam=0x138e7dc) returned 0x0 [0047.464] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502ba, Msg=0x1, wParam=0x0, lParam=0x138e7f0) returned 0x0 [0047.465] GetClientRect (in: hWnd=0x502ba, lpRect=0x138e4d8 | out: lpRect=0x138e4d8) returned 1 [0047.465] GetWindowRect (in: hWnd=0x502ba, lpRect=0x138e4d8 | out: lpRect=0x138e4d8) returned 1 [0047.466] GetParent (hWnd=0x502ba) returned 0x0 [0047.467] DeactivateActCtx (dwFlags=0x0, ulCookie=0x13de0001) returned 1 [0047.490] EtwEventRegister (in: ProviderId=0x3275e98, EnableCallback=0x322060e, CallbackContext=0x0, RegHandle=0x3275e74 | out: RegHandle=0x3275e74) returned 0x0 [0047.499] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0047.499] AdjustWindowRectEx (in: lpRect=0x138ef04, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x138ef04) returned 1 [0047.499] GetSystemMetrics (nIndex=59) returned 1460 [0047.499] GetSystemMetrics (nIndex=60) returned 920 [0047.499] GetSystemMetrics (nIndex=34) returned 136 [0047.499] GetSystemMetrics (nIndex=35) returned 39 [0047.500] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0047.500] AdjustWindowRectEx (in: lpRect=0x138ee04, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x138ee04) returned 1 [0047.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", nBufferLength=0x105, lpBuffer=0x138e7d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config", lpFilePart=0x0) returned 0x2e [0047.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138ec94) returned 1 [0047.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x138ed10 | out: lpFileInformation=0x138ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138ec90) returned 1 [0048.029] GetSystemMetrics (nIndex=11) returned 32 [0048.029] GetSystemMetrics (nIndex=12) returned 32 [0048.030] GetDC (hWnd=0x0) returned 0x60100ce [0048.032] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0048.032] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0048.032] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0048.033] CreateIconFromResourceEx (presbits=0x3289078, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x660297 [0048.046] CreateCompatibleDC (hdc=0x0) returned 0x650104fd [0048.048] GetSystemDefaultLCID () returned 0x409 [0048.048] GetStockObject (i=17) returned 0xa01c1 [0048.049] GetObjectW (in: h=0xa01c1, c=92, pv=0x138ec54 | out: pv=0x138ec54) returned 92 [0048.050] GetDC (hWnd=0x0) returned 0x60100ce [0048.110] GdiplusStartup (in: token=0x1465ee8, input=0x138e208, output=0x138e258 | out: token=0x1465ee8, output=0x138e258) returned 0x0 [0048.116] CoTaskMemAlloc (cb=0x5c) returned 0x16a1168 [0048.117] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x16a1168, font=0x138ed1c) returned 0x0 [0048.421] CoTaskMemFree (pv=0x16a1168) [0048.421] CoTaskMemAlloc (cb=0x5c) returned 0x16a1510 [0048.422] CoTaskMemFree (pv=0x16a1510) [0048.422] CoTaskMemAlloc (cb=0x5c) returned 0x16a1510 [0048.423] CoTaskMemFree (pv=0x16a1510) [0048.423] GdipGetFontUnit (font=0x5a61f08, unit=0x138ece4) returned 0x0 [0048.423] GdipGetFontSize (font=0x5a61f08, size=0x138ece8) returned 0x0 [0048.423] GdipGetFontStyle (font=0x5a61f08, style=0x138ece0) returned 0x0 [0048.424] GdipGetFamily (font=0x5a61f08, family=0x138ecdc) returned 0x0 [0048.424] GdipGetFontSize (font=0x5a61f08, size=0x328a5e4) returned 0x0 [0048.424] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0048.424] GetDC (hWnd=0x0) returned 0xf0105ee [0048.425] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x138ecf8) returned 0x0 [0048.430] GdipGetDpiY (graphics=0x6b7f260, dpi=0x328a6c0) returned 0x0 [0048.431] GdipGetFontHeight (font=0x5a61f08, graphics=0x6b7f260, height=0x138ecf0) returned 0x0 [0048.431] GdipGetEmHeight (family=0x5a68170, style=0, EmHeight=0x138ecf8) returned 0x0 [0048.431] GdipGetLineSpacing (family=0x5a68170, style=0, LineSpacing=0x138ecf8) returned 0x0 [0048.431] GdipDeleteGraphics (graphics=0x6b7f260) returned 0x0 [0048.431] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0048.433] GdipCreateFont (fontFamily=0x5a68170, emSize=0x41040000, style=0, unit=0x3, font=0x328a6dc) returned 0x0 [0048.433] GdipGetFontSize (font=0x5a6ef48, size=0x328a6e0) returned 0x0 [0048.433] GdipDeleteFont (font=0x5a61f08) returned 0x0 [0048.433] GetDC (hWnd=0x0) returned 0xf0105ee [0048.433] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x138ed2c) returned 0x0 [0048.434] CoTaskMemAlloc (cb=0x5c) returned 0x16a1648 [0048.435] GdipGetLogFontW (font=0x5a6ef48, graphics=0x6b7f260, logfontW=0x16a1648) returned 0x0 [0048.438] CoTaskMemFree (pv=0x16a1648) [0048.438] CoTaskMemAlloc (cb=0x5c) returned 0x16a14a8 [0048.438] CoTaskMemFree (pv=0x16a14a8) [0048.438] CoTaskMemAlloc (cb=0x5c) returned 0x16a13d8 [0048.439] CoTaskMemFree (pv=0x16a13d8) [0048.439] GdipDeleteGraphics (graphics=0x6b7f260) returned 0x0 [0048.439] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0048.439] CoTaskMemAlloc (cb=0x5c) returned 0x16a1308 [0048.439] CreateFontIndirectW (lplf=0x16a1308) returned 0x7f0a0512 [0048.439] CoTaskMemFree (pv=0x16a1308) [0048.439] SelectObject (hdc=0x650104fd, h=0x7f0a0512) returned 0x8a01c2 [0048.440] GetTextMetricsW (in: hdc=0x650104fd, lptm=0x138ee38 | out: lptm=0x138ee38) returned 1 [0048.440] GetTextExtentPoint32W (in: hdc=0x650104fd, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x328a908 | out: psizl=0x328a908) returned 1 [0048.442] SelectObject (hdc=0x650104fd, h=0x8a01c2) returned 0x7f0a0512 [0048.444] DeleteDC (hdc=0x650104fd) returned 1 [0048.444] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0048.444] AdjustWindowRectEx (in: lpRect=0x138eb80, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x138eb80) returned 1 [0048.444] AdjustWindowRectEx (in: lpRect=0x138edc4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x138edc4) returned 1 [0048.445] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0048.445] AdjustWindowRectEx (in: lpRect=0x138eaf8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x138eaf8) returned 1 [0048.445] AdjustWindowRectEx (in: lpRect=0x138ebfc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x138ebfc) returned 1 [0048.445] GetSystemMetrics (nIndex=34) returned 136 [0048.445] GetSystemMetrics (nIndex=35) returned 39 [0048.445] GetCurrentActCtx (in: lphActCtx=0x138ef8c | out: lphActCtx=0x138ef8c*=0x0) returned 1 [0048.445] ActivateActCtx (in: hActCtx=0x16a66dc, lpCookie=0x138ef9c | out: hActCtx=0x16a66dc, lpCookie=0x138ef9c) returned 1 [0048.446] GetCurrentActCtx (in: lphActCtx=0x138edac | out: lphActCtx=0x138edac*=0x16a66dc) returned 1 [0048.446] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0048.446] AdjustWindowRectEx (in: lpRect=0x138ecec, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x138ecec) returned 1 [0048.446] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.446] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0xfc0000, lpParam=0x0) returned 0x202c4 [0048.461] SetWindowLongW (hWnd=0x202c4, nIndex=-4, dwNewLong=1950089536) returned 52561342 [0048.461] GetWindowLongW (hWnd=0x202c4, nIndex=-4) returned 1950089536 [0048.461] SetWindowLongW (hWnd=0x202c4, nIndex=-4, dwNewLong=52561462) returned 1950089536 [0048.461] GetWindowLongW (hWnd=0x202c4, nIndex=-4) returned 52561462 [0048.461] GetWindowLongW (hWnd=0x202c4, nIndex=-16) returned 114229248 [0048.461] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x81, wParam=0x0, lParam=0x138e7d0) returned 0x1 [0048.464] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x83, wParam=0x0, lParam=0x138e7bc) returned 0x0 [0048.465] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x1, wParam=0x0, lParam=0x138e7d0) returned 0x0 [0048.465] GetClientRect (in: hWnd=0x202c4, lpRect=0x138e488 | out: lpRect=0x138e488) returned 1 [0048.465] GetWindowRect (in: hWnd=0x202c4, lpRect=0x138e488 | out: lpRect=0x138e488) returned 1 [0048.466] SetWindowTextW (hWnd=0x202c4, lpString="hidden tear") returned 1 [0048.466] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xc, wParam=0x0, lParam=0x3275adc) returned 0x1 [0048.475] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x328ae24, nLength=0xc, lpnLengthNeeded=0x138e380 | out: pvInfo=0x328ae24, lpnLengthNeeded=0x138e380) returned 1 [0048.478] SetConsoleCtrlHandler (HandlerRoutine=0x322065e, Add=1) returned 1 [0048.478] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.478] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.479] GetClassInfoW (in: hInstance=0xfc0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x328ae88 | out: lpWndClass=0x328ae88) returned 0 [0048.481] CoTaskMemAlloc (cb=0x58) returned 0x169eb90 [0048.481] RegisterClassW (lpWndClass=0x138e2d0) returned 0xc19d [0048.481] CoTaskMemFree (pv=0x169eb90) [0048.482] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xfc0000, lpParam=0x0) returned 0x70030 [0048.483] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0x138ddfc) returned 0x0 [0048.483] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0x138de10) returned 0x0 [0048.483] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0048.484] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0048.488] GetStartupInfoW (in: lpStartupInfo=0x328b2e0 | out: lpStartupInfo=0x328b2e0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0048.489] GetParent (hWnd=0x202c4) returned 0x0 [0048.489] SetWindowLongW (hWnd=0x202c4, nIndex=-8, dwNewLong=0) returned 0 [0048.490] GetSystemMetrics (nIndex=49) returned 16 [0048.490] GetSystemMetrics (nIndex=50) returned 16 [0048.491] CreateIconFromResourceEx (presbits=0x328b360, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x1c0129 [0048.492] SendMessageW (hWnd=0x202c4, Msg=0x80, wParam=0x0, lParam=0x1c0129) returned 0x0 [0048.492] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x80, wParam=0x0, lParam=0x1c0129) returned 0x0 [0048.492] SendMessageW (hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.492] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.493] GetSystemMenu (hWnd=0x202c4, bRevert=0) returned 0x50211 [0048.510] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138edbc | out: lpwndpl=0x138edbc) returned 1 [0048.510] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0048.510] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0048.510] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0048.510] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0048.510] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0048.510] GetClientRect (in: hWnd=0x202c4, lpRect=0x138ee00 | out: lpRect=0x138ee00) returned 1 [0048.510] GetClientRect (in: hWnd=0x202c4, lpRect=0x138ed60 | out: lpRect=0x138ed60) returned 1 [0048.510] GetWindowRect (in: hWnd=0x202c4, lpRect=0x138ed60 | out: lpRect=0x138ed60) returned 1 [0048.510] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0048.510] GetWindowLongW (hWnd=0x202c4, nIndex=-16) returned 114229248 [0048.511] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.511] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.511] GetSystemMetrics (nIndex=42) returned 0 [0048.511] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138ecd8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.511] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138ecd8) returned 0xb [0048.511] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.511] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.511] GetSystemMetrics (nIndex=42) returned 0 [0048.512] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138ecd8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.512] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138ecd8) returned 0xb [0048.512] GetWindowLongW (hWnd=0x202c4, nIndex=-16) returned 114229248 [0048.512] GetWindowLongW (hWnd=0x202c4, nIndex=-20) returned 328064 [0048.512] SetWindowLongW (hWnd=0x202c4, nIndex=-16, dwNewLong=47120384) returned 114229248 [0048.512] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7c, wParam=0xfffffff0, lParam=0x138ed5c) returned 0x0 [0048.512] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7d, wParam=0xfffffff0, lParam=0x138ed5c) returned 0x0 [0048.514] SetWindowLongW (hWnd=0x202c4, nIndex=-20, dwNewLong=327808) returned 328064 [0048.514] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7c, wParam=0xffffffec, lParam=0x138ed5c) returned 0x0 [0048.514] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7d, wParam=0xffffffec, lParam=0x138ed5c) returned 0x0 [0048.515] SetWindowPos (hWnd=0x202c4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0048.515] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x138ed74) returned 0x0 [0048.515] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x83, wParam=0x1, lParam=0x138ed4c) returned 0x0 [0048.516] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138eaa0 | out: lpwndpl=0x138eaa0) returned 1 [0048.516] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x47, wParam=0x0, lParam=0x138ed74) returned 0x0 [0048.516] GetClientRect (in: hWnd=0x202c4, lpRect=0x138ea50 | out: lpRect=0x138ea50) returned 1 [0048.516] GetWindowRect (in: hWnd=0x202c4, lpRect=0x138ea50 | out: lpRect=0x138ea50) returned 1 [0048.517] RedrawWindow (hWnd=0x202c4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0048.517] GetSystemMenu (hWnd=0x202c4, bRevert=0) returned 0x50211 [0048.517] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138edac | out: lpwndpl=0x138edac) returned 1 [0048.517] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0048.517] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0048.517] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0048.517] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0048.517] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0048.517] ShowWindow (hWnd=0x202c4, nCmdShow=5) returned 0 [0048.518] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0048.518] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.518] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.518] GetSystemMetrics (nIndex=42) returned 0 [0048.518] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138e99c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.518] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138e99c) returned 0xb [0048.527] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0048.527] GetWindowLongW (hWnd=0x202c4, nIndex=-16) returned 114229248 [0048.527] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.527] GetSystemMetrics (nIndex=42) returned 0 [0048.527] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138e87c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138e87c) returned 0xb [0048.527] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.527] GetSystemMetrics (nIndex=42) returned 0 [0048.527] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138e87c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138e87c) returned 0xb [0048.527] GetWindowLongW (hWnd=0x202c4, nIndex=-16) returned 114229248 [0048.527] GetWindowLongW (hWnd=0x202c4, nIndex=-20) returned 328064 [0048.527] SetWindowLongW (hWnd=0x202c4, nIndex=-16, dwNewLong=315555840) returned 114229248 [0048.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7c, wParam=0xfffffff0, lParam=0x138e904) returned 0x0 [0048.535] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7d, wParam=0xfffffff0, lParam=0x138e904) returned 0x0 [0048.535] SetWindowLongW (hWnd=0x202c4, nIndex=-20, dwNewLong=852096) returned 328064 [0048.535] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7c, wParam=0xffffffec, lParam=0x138e904) returned 0x0 [0048.536] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x7d, wParam=0xffffffec, lParam=0x138e904) returned 0x0 [0048.536] SetWindowPos (hWnd=0x202c4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0048.536] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x138e91c) returned 0x0 [0048.536] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x83, wParam=0x1, lParam=0x138e8f4) returned 0x0 [0048.538] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x85, wParam=0x1204062a, lParam=0x0) returned 0x0 [0048.539] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138e664 | out: lpwndpl=0x138e664) returned 1 [0048.539] GetClientRect (in: hWnd=0x202c4, lpRect=0x138e610 | out: lpRect=0x138e610) returned 1 [0048.539] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.539] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.539] GetSystemMetrics (nIndex=42) returned 0 [0048.539] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138e4d0, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.539] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138e4d0) returned 0xb [0048.539] GetClientRect (in: hWnd=0x202c4, lpRect=0x138e518 | out: lpRect=0x138e518) returned 1 [0048.540] GetSysColor (nIndex=10) returned 0xb4b4b4 [0048.540] GetSysColor (nIndex=2) returned 0xd1b499 [0048.540] GetSysColor (nIndex=9) returned 0x0 [0048.540] GetSysColor (nIndex=12) returned 0xababab [0048.540] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.540] GetSysColor (nIndex=20) returned 0xffffff [0048.540] GetSysColor (nIndex=16) returned 0xa0a0a0 [0048.540] GetSysColor (nIndex=15) returned 0xf0f0f0 [0048.540] GetSysColor (nIndex=16) returned 0xa0a0a0 [0048.540] GetSysColor (nIndex=21) returned 0x696969 [0048.541] GetSysColor (nIndex=22) returned 0xe3e3e3 [0048.541] GetSysColor (nIndex=20) returned 0xffffff [0048.541] GetSysColor (nIndex=18) returned 0x0 [0048.541] GetSysColor (nIndex=1) returned 0x0 [0048.541] GetSysColor (nIndex=27) returned 0xead1b9 [0048.541] GetSysColor (nIndex=28) returned 0xf2e4d7 [0048.541] GetSysColor (nIndex=17) returned 0x6d6d6d [0048.541] GetSysColor (nIndex=13) returned 0xd77800 [0048.541] GetSysColor (nIndex=14) returned 0xffffff [0048.541] GetSysColor (nIndex=26) returned 0xcc6600 [0048.541] GetSysColor (nIndex=11) returned 0xfcf7f4 [0048.541] GetSysColor (nIndex=3) returned 0xdbcdbf [0048.541] GetSysColor (nIndex=19) returned 0x0 [0048.541] GetSysColor (nIndex=24) returned 0xe1ffff [0048.541] GetSysColor (nIndex=23) returned 0x0 [0048.541] GetSysColor (nIndex=4) returned 0xf0f0f0 [0048.541] GetSysColor (nIndex=30) returned 0xf0f0f0 [0048.541] GetSysColor (nIndex=29) returned 0xd77800 [0048.541] GetSysColor (nIndex=7) returned 0x0 [0048.541] GetSysColor (nIndex=0) returned 0xc8c8c8 [0048.541] GetSysColor (nIndex=5) returned 0xffffff [0048.541] GetSysColor (nIndex=6) returned 0x646464 [0048.541] GetSysColor (nIndex=8) returned 0x0 [0048.542] GetSystemMetrics (nIndex=80) returned 1 [0048.548] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x32206ae, dwData=0x0) returned 1 [0048.558] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x138e178 | out: lpmi=0x138e178) returned 1 [0048.559] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x370107a7 [0048.559] GetDeviceCaps (hdc=0x370107a7, index=12) returned 32 [0048.559] GetDeviceCaps (hdc=0x370107a7, index=14) returned 1 [0048.559] DeleteDC (hdc=0x370107a7) returned 1 [0048.559] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0048.559] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0048.559] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x9050627 [0048.560] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0048.560] SaveDC (hdc=0xf0105ee) returned 1 [0048.560] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0048.561] CreateSolidBrush (color=0xf0f0f0) returned 0x54100798 [0048.561] FillRect (hDC=0xf0105ee, lprc=0x138e3b8, hbr=0x54100798) returned 1 [0048.561] DeleteObject (ho=0x54100798) returned 1 [0048.561] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0048.563] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138e648 | out: lpwndpl=0x138e648) returned 1 [0048.563] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x47, wParam=0x0, lParam=0x138e91c) returned 0x0 [0048.563] GetClientRect (in: hWnd=0x202c4, lpRect=0x138e5f8 | out: lpRect=0x138e5f8) returned 1 [0048.563] GetWindowRect (in: hWnd=0x202c4, lpRect=0x138e5f8 | out: lpRect=0x138e5f8) returned 1 [0048.564] RedrawWindow (hWnd=0x202c4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0048.564] GetSystemMenu (hWnd=0x202c4, bRevert=0) returned 0x50211 [0048.564] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138e950 | out: lpwndpl=0x138e950) returned 1 [0048.564] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0048.564] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0048.564] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0048.564] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0048.564] EnableMenuItem (hMenu=0x50211, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0048.587] SetLayeredWindowAttributes (hwnd=0x202c4, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0048.592] GetCurrentThreadId () returned 0x13dc [0048.597] EnumThreadWindows (dwThreadId=0x13dc, lpfn=0x32206d6, lParam=0x202c4) returned 1 [0048.622] GetWindowLongW (hWnd=0x70030, nIndex=-8) returned 0 [0048.623] GetWindowLongW (hWnd=0x202c4, nIndex=-8) returned 0 [0048.623] GetWindowLongW (hWnd=0x901f8, nIndex=-8) returned 131780 [0048.652] SetWindowLongW (hWnd=0x901f8, nIndex=-8, dwNewLong=0) returned 131780 [0048.655] GetParent (hWnd=0x202c4) returned 0x0 [0048.655] GetWindowLongW (hWnd=0x202c4, nIndex=-20) returned 852352 [0048.655] DestroyWindow (hWnd=0x202c4) returned 1 [0048.656] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0048.656] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x138e84c) returned 0x0 [0048.658] GetWindowPlacement (in: hWnd=0x202c4, lpwndpl=0x138e578 | out: lpwndpl=0x138e578) returned 1 [0048.659] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x47, wParam=0x0, lParam=0x138e84c) returned 0x0 [0048.659] GetClientRect (in: hWnd=0x202c4, lpRect=0x138e528 | out: lpRect=0x138e528) returned 1 [0048.659] GetWindowRect (in: hWnd=0x202c4, lpRect=0x138e528 | out: lpRect=0x138e528) returned 1 [0048.661] GetWindowTextLengthW (hWnd=0x202c4) returned 11 [0048.661] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.661] GetSystemMetrics (nIndex=42) returned 0 [0048.661] GetWindowTextW (in: hWnd=0x202c4, lpString=0x138e44c, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.661] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0xd, wParam=0xc, lParam=0x138e44c) returned 0xb [0048.661] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0048.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202c4, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0048.664] GetCurrentActCtx (in: lphActCtx=0x138e8b0 | out: lphActCtx=0x138e8b0*=0x16a66dc) returned 1 [0048.664] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0048.664] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.665] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="hidden tear", dwStyle=0x2cf0000, X=104, Y=104, nWidth=140, nHeight=92, hWndParent=0x0, hMenu=0x0, hInstance=0xfc0000, lpParam=0x0) returned 0x6002e [0048.665] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=1950089536) returned 52561342 [0048.665] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 1950089536 [0048.665] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=52561662) returned 1950089536 [0048.665] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 52561662 [0048.665] GetWindowLongW (hWnd=0x6002e, nIndex=-16) returned 114229248 [0048.666] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x81, wParam=0x0, lParam=0x138e2d0) returned 0x1 [0048.667] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x0, lParam=0x138e2bc) returned 0x0 [0048.667] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x1, wParam=0x0, lParam=0x138e2d0) returned 0x0 [0048.667] GetClientRect (in: hWnd=0x6002e, lpRect=0x138df88 | out: lpRect=0x138df88) returned 1 [0048.667] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138df88 | out: lpRect=0x138df88) returned 1 [0048.667] SetWindowTextW (hWnd=0x6002e, lpString="hidden tear") returned 1 [0048.667] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xc, wParam=0x0, lParam=0x328c7e8) returned 0x1 [0048.668] SetLayeredWindowAttributes (hwnd=0x6002e, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0048.669] GetStartupInfoW (in: lpStartupInfo=0x328cac4 | out: lpStartupInfo=0x328cac4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0048.670] GetParent (hWnd=0x6002e) returned 0x0 [0048.670] GetStockObject (i=5) returned 0x900015 [0048.670] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.670] CoTaskMemAlloc (cb=0x5a) returned 0x16a1168 [0048.670] RegisterClassW (lpWndClass=0x138e78c) returned 0xc19e [0048.670] CoTaskMemFree (pv=0x16a1168) [0048.671] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0048.671] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xfc0000, lpParam=0x0) returned 0x7005c [0048.671] SetWindowLongW (hWnd=0x7005c, nIndex=-4, dwNewLong=1950089536) returned 52561702 [0048.671] GetWindowLongW (hWnd=0x7005c, nIndex=-4) returned 1950089536 [0048.671] SetWindowLongW (hWnd=0x7005c, nIndex=-4, dwNewLong=52561742) returned 1950089536 [0048.671] GetWindowLongW (hWnd=0x7005c, nIndex=-4) returned 52561742 [0048.671] GetWindowLongW (hWnd=0x7005c, nIndex=-16) returned 79691776 [0048.673] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x24, wParam=0x0, lParam=0x138e304) returned 0x0 [0048.673] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x81, wParam=0x0, lParam=0x138e2f8) returned 0x1 [0048.673] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x0, lParam=0x138e2e4) returned 0x0 [0048.676] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x1, wParam=0x0, lParam=0x138e2f8) returned 0x0 [0048.676] SetWindowLongW (hWnd=0x6002e, nIndex=-8, dwNewLong=458844) returned 0 [0048.678] SendMessageW (hWnd=0x6002e, Msg=0x80, wParam=0x0, lParam=0x1c0129) returned 0x0 [0048.678] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x80, wParam=0x0, lParam=0x1c0129) returned 0x0 [0048.678] SendMessageW (hWnd=0x6002e, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.678] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.710] GetSystemMenu (hWnd=0x6002e, bRevert=0) returned 0x60211 [0048.710] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e8c0 | out: lpwndpl=0x138e8c0) returned 1 [0048.710] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0048.710] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0048.710] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0048.710] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0048.710] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0048.710] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e904 | out: lpRect=0x138e904) returned 1 [0048.710] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e864 | out: lpRect=0x138e864) returned 1 [0048.710] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138e864 | out: lpRect=0x138e864) returned 1 [0048.710] SetWindowPos (hWnd=0x6002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0048.710] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x138e7cc) returned 0x0 [0048.714] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0048.716] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e514 | out: lpwndpl=0x138e514) returned 1 [0048.716] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e4c0 | out: lpRect=0x138e4c0) returned 1 [0048.716] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0048.716] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.716] GetSystemMetrics (nIndex=42) returned 0 [0048.716] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e380, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.716] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e380) returned 0xb [0048.716] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e3c8 | out: lpRect=0x138e3c8) returned 1 [0048.716] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0048.716] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0048.716] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0xffffffffaa050796 [0048.716] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0048.716] SaveDC (hdc=0x60100ce) returned 1 [0048.716] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0048.716] CreateSolidBrush (color=0xf0f0f0) returned 0x55100798 [0048.716] FillRect (hDC=0x60100ce, lprc=0x138e268, hbr=0x55100798) returned 1 [0048.716] DeleteObject (ho=0x55100798) returned 1 [0048.716] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0048.716] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e4f8 | out: lpwndpl=0x138e4f8) returned 1 [0048.717] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x138e7cc) returned 0x0 [0048.717] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e4a8 | out: lpRect=0x138e4a8) returned 1 [0048.717] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138e4a8 | out: lpRect=0x138e4a8) returned 1 [0048.719] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x1, lParam=0x138e2e4) returned 0x0 [0048.721] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0048.723] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e054 | out: lpwndpl=0x138e054) returned 1 [0048.723] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e000 | out: lpRect=0x138e000) returned 1 [0048.723] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0048.723] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.723] GetSystemMetrics (nIndex=42) returned 0 [0048.723] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138dec0, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.723] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138dec0) returned 0xb [0048.723] GetClientRect (in: hWnd=0x6002e, lpRect=0x138df08 | out: lpRect=0x138df08) returned 1 [0048.723] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0048.723] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0048.723] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0xffffffffaa050796 [0048.723] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0048.723] SaveDC (hdc=0x10105d6) returned 1 [0048.723] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0048.723] CreateSolidBrush (color=0xf0f0f0) returned 0x56100798 [0048.723] FillRect (hDC=0x10105d6, lprc=0x138dda8, hbr=0x56100798) returned 1 [0048.723] DeleteObject (ho=0x56100798) returned 1 [0048.723] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0048.724] SetWindowLongW (hWnd=0x6002e, nIndex=-8, dwNewLong=458844) returned 458844 [0048.725] SendMessageW (hWnd=0x7005c, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.725] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x80, wParam=0x1, lParam=0x660297) returned 0x0 [0048.726] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0048.727] GetWindowLongW (hWnd=0x6002e, nIndex=-16) returned 382664704 [0048.727] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.727] GetSystemMetrics (nIndex=42) returned 0 [0048.727] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e7dc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e7dc) returned 0xb [0048.727] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.727] GetSystemMetrics (nIndex=42) returned 0 [0048.727] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e7dc, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e7dc) returned 0xb [0048.727] GetWindowLongW (hWnd=0x6002e, nIndex=-16) returned 382664704 [0048.727] GetWindowLongW (hWnd=0x6002e, nIndex=-20) returned 590208 [0048.727] SetWindowLongW (hWnd=0x6002e, nIndex=-16, dwNewLong=315555840) returned 382664704 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x7c, wParam=0xfffffff0, lParam=0x138e864) returned 0x0 [0048.727] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x7d, wParam=0xfffffff0, lParam=0x138e864) returned 0x0 [0048.728] SetWindowLongW (hWnd=0x6002e, nIndex=-20, dwNewLong=589952) returned 590208 [0048.728] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x7c, wParam=0xffffffec, lParam=0x138e864) returned 0x0 [0048.728] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x7d, wParam=0xffffffec, lParam=0x138e864) returned 0x0 [0048.729] SetWindowPos (hWnd=0x6002e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0048.729] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x138e87c) returned 0x0 [0048.729] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x1, lParam=0x138e854) returned 0x0 [0048.730] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0048.731] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e5c4 | out: lpwndpl=0x138e5c4) returned 1 [0048.731] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e570 | out: lpRect=0x138e570) returned 1 [0048.731] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0048.731] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0048.731] GetSystemMetrics (nIndex=42) returned 0 [0048.731] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e430, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0048.731] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e430) returned 0xb [0048.731] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e478 | out: lpRect=0x138e478) returned 1 [0048.731] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0048.731] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0048.731] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0xffffffffaa050796 [0048.732] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0048.732] SaveDC (hdc=0x60100ce) returned 1 [0048.732] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0048.732] CreateSolidBrush (color=0xf0f0f0) returned 0x57100798 [0048.732] FillRect (hDC=0x60100ce, lprc=0x138e318, hbr=0x57100798) returned 1 [0048.732] DeleteObject (ho=0x57100798) returned 1 [0048.732] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0048.732] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e5a8 | out: lpwndpl=0x138e5a8) returned 1 [0048.732] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x138e87c) returned 0x0 [0048.732] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e558 | out: lpRect=0x138e558) returned 1 [0048.732] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138e558 | out: lpRect=0x138e558) returned 1 [0048.733] RedrawWindow (hWnd=0x6002e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0048.733] GetSystemMenu (hWnd=0x6002e, bRevert=0) returned 0x60211 [0048.733] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e8b0 | out: lpwndpl=0x138e8b0) returned 1 [0048.733] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0048.733] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0048.733] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0048.733] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0048.733] EnableMenuItem (hMenu=0x60211, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0048.733] SetWindowLongW (hWnd=0x901f8, nIndex=-8, dwNewLong=393262) returned 458800 [0048.754] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ru", nBufferLength=0x105, lpBuffer=0x138e434, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ru", lpFilePart=0x0) returned 0xc [0048.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8e4) returned 1 [0048.755] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\ru" (normalized: "c:\\fd1hvy\\ru"), fInfoLevelId=0x0, lpFileInformation=0x138e960 | out: lpFileInformation=0x138e960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e8e0) returned 1 [0048.755] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ru", nBufferLength=0x105, lpBuffer=0x138e43c, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ru", lpFilePart=0x0) returned 0xc [0048.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e878) returned 1 [0048.755] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\ru" (normalized: "c:\\fd1hvy\\ru"), fInfoLevelId=0x0, lpFileInformation=0x138e8f4 | out: lpFileInformation=0x138e8f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e874) returned 1 [0048.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e878) returned 1 [0048.756] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\ru" (normalized: "c:\\fd1hvy\\ru"), fInfoLevelId=0x0, lpFileInformation=0x138e8f4 | out: lpFileInformation=0x138e8f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e874) returned 1 [0048.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e878) returned 1 [0048.756] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x138e8f4 | out: lpFileInformation=0x138e8f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e874) returned 1 [0048.765] CreateDirectoryW (lpPathName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), lpSecurityAttributes=0x0) returned 1 [0048.766] CreateDirectoryW (lpPathName="C:\\FD1HVy\\ru" (normalized: "c:\\fd1hvy\\ru"), lpSecurityAttributes=0x0) returned 1 [0048.769] GetCurrentProcessId () returned 0x13d8 [0048.778] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x138e26c | out: lpLuid=0x138e26c*(LowPart=0x14, HighPart=0)) returned 1 [0048.780] GetCurrentProcess () returned 0xffffffff [0048.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x138e268 | out: TokenHandle=0x138e268*=0x350) returned 1 [0048.780] AdjustTokenPrivileges (in: TokenHandle=0x350, DisableAllPrivileges=0, NewState=0x328d954*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0048.780] CloseHandle (hObject=0x350) returned 1 [0048.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4271a48, Length=0x20000, ResultLength=0x138e954 | out: SystemInformation=0x4271a48, ResultLength=0x138e954*=0x246c8) returned 0xc0000004 [0048.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4291a68, Length=0x26ec8, ResultLength=0x138e954 | out: SystemInformation=0x4291a68, ResultLength=0x138e954*=0x1a8c8) returned 0x0 [0048.856] CoTaskMemAlloc (cb=0x20e) returned 0x16c45e8 [0048.856] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x16c45e8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0048.856] CoTaskMemFree (pv=0x16c45e8) [0048.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e448, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0048.859] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ru\\ru.exe", nBufferLength=0x105, lpBuffer=0x138e448, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ru\\ru.exe", lpFilePart=0x0) returned 0x13 [0048.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8fc) returned 1 [0048.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), fInfoLevelId=0x0, lpFileInformation=0x138e978 | out: lpFileInformation=0x138e978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0abdc00, ftCreationTime.dwHighDateTime=0x1d6eb12, ftLastAccessTime.dwLowDateTime=0xb0abdc00, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xae498200, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x35a00)) returned 1 [0048.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e8f8) returned 1 [0048.859] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), lpNewFileName="C:\\FD1HVy\\ru\\ru.exe" (normalized: "c:\\fd1hvy\\ru\\ru.exe")) returned 1 [0049.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0049.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0049.009] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xbc183da9, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xce1114b3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d4b8 [0049.009] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xbc183da9, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xce1114b3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.010] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d20ca50, ftCreationTime.dwHighDateTime=0x1d5ea9c, ftLastAccessTime.dwLowDateTime=0x7bcc680, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0x7bcc680, ftLastWriteTime.dwHighDateTime=0x1d5e9a7, nFileSizeHigh=0x0, nFileSizeLow=0xe7f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oOWejWsgFpbJi.avi", cAlternateFileName="-OOWEJ~1.AVI")) returned 1 [0049.010] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a165d0, ftCreationTime.dwHighDateTime=0x1d5e7bd, ftLastAccessTime.dwLowDateTime=0x76ee69a0, ftLastAccessTime.dwHighDateTime=0x1d5e63c, ftLastWriteTime.dwLowDateTime=0x76ee69a0, ftLastWriteTime.dwHighDateTime=0x1d5e63c, nFileSizeHigh=0x0, nFileSizeLow=0x132d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Lu6NY1C.mp3", cAlternateFileName="")) returned 1 [0049.010] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b63d430, ftCreationTime.dwHighDateTime=0x1d5ee97, ftLastAccessTime.dwLowDateTime=0x2395340, ftLastAccessTime.dwHighDateTime=0x1d5e3fd, ftLastWriteTime.dwLowDateTime=0x2395340, ftLastWriteTime.dwHighDateTime=0x1d5e3fd, nFileSizeHigh=0x0, nFileSizeLow=0xbc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eS-i4hM.m4a", cAlternateFileName="")) returned 1 [0049.010] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa565a6d0, ftCreationTime.dwHighDateTime=0x1d5ed40, ftLastAccessTime.dwLowDateTime=0xfdf6750, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0xfdf6750, ftLastWriteTime.dwHighDateTime=0x1d5e0fb, nFileSizeHigh=0x0, nFileSizeLow=0x84e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="4phdci9dUrTtxEhd5.png", cAlternateFileName="4PHDCI~1.PNG")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abc90, ftCreationTime.dwHighDateTime=0x1d5eb9a, ftLastAccessTime.dwLowDateTime=0xf41c3f50, ftLastAccessTime.dwHighDateTime=0x1d5e84f, ftLastWriteTime.dwLowDateTime=0xf41c3f50, ftLastWriteTime.dwHighDateTime=0x1d5e84f, nFileSizeHigh=0x0, nFileSizeLow=0x15c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GZj_.ppt", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7582f5a0, ftCreationTime.dwHighDateTime=0x1d5e2c1, ftLastAccessTime.dwLowDateTime=0x660f05f0, ftLastAccessTime.dwHighDateTime=0x1d5ead2, ftLastWriteTime.dwLowDateTime=0x660f05f0, ftLastWriteTime.dwHighDateTime=0x1d5ead2, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XkMBpJLi1Me6-.odp", cAlternateFileName="6XKMBP~1.ODP")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf11700, ftCreationTime.dwHighDateTime=0x1d5e44f, ftLastAccessTime.dwLowDateTime=0x415e7d20, ftLastAccessTime.dwHighDateTime=0x1d5e619, ftLastWriteTime.dwLowDateTime=0x415e7d20, ftLastWriteTime.dwHighDateTime=0x1d5e619, nFileSizeHigh=0x0, nFileSizeLow=0xb474, dwReserved0=0x0, dwReserved1=0x0, cFileName="6YEj.gif", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcbcfc0, ftCreationTime.dwHighDateTime=0x1d5e4d5, ftLastAccessTime.dwLowDateTime=0xa7dac2a0, ftLastAccessTime.dwHighDateTime=0x1d5e215, ftLastWriteTime.dwLowDateTime=0xa7dac2a0, ftLastWriteTime.dwHighDateTime=0x1d5e215, nFileSizeHigh=0x0, nFileSizeLow=0x18577, dwReserved0=0x0, dwReserved1=0x0, cFileName="99M_21.mp4", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761effa0, ftCreationTime.dwHighDateTime=0x1d5e513, ftLastAccessTime.dwLowDateTime=0x8df58690, ftLastAccessTime.dwHighDateTime=0x1d5e6f2, ftLastWriteTime.dwLowDateTime=0x8df58690, ftLastWriteTime.dwHighDateTime=0x1d5e6f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aHL2OKuyfw1Y.flv", cAlternateFileName="AHL2OK~1.FLV")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f73ea0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x405c8f30, ftLastAccessTime.dwHighDateTime=0x1d5ecf8, ftLastWriteTime.dwLowDateTime=0x405c8f30, ftLastWriteTime.dwHighDateTime=0x1d5ecf8, nFileSizeHigh=0x0, nFileSizeLow=0xaebd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDIUES.wav", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4768d0, ftCreationTime.dwHighDateTime=0x1d5f042, ftLastAccessTime.dwLowDateTime=0x16351c30, ftLastAccessTime.dwHighDateTime=0x1d5e317, ftLastWriteTime.dwLowDateTime=0x16351c30, ftLastWriteTime.dwHighDateTime=0x1d5e317, nFileSizeHigh=0x0, nFileSizeLow=0x29e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BwCWt.swf", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4dc4150, ftCreationTime.dwHighDateTime=0x1d5eec1, ftLastAccessTime.dwLowDateTime=0x2a8d4660, ftLastAccessTime.dwHighDateTime=0x1d5ed3c, ftLastWriteTime.dwLowDateTime=0x2a8d4660, ftLastWriteTime.dwHighDateTime=0x1d5ed3c, nFileSizeHigh=0x0, nFileSizeLow=0x8d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BzFCpK3sA5 wIqY9MGu.jpg", cAlternateFileName="BZFCPK~1.JPG")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.011] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bea64b0, ftCreationTime.dwHighDateTime=0x1d5ef3f, ftLastAccessTime.dwLowDateTime=0x65bfd110, ftLastAccessTime.dwHighDateTime=0x1d5e68b, ftLastWriteTime.dwLowDateTime=0x65bfd110, ftLastWriteTime.dwHighDateTime=0x1d5e68b, nFileSizeHigh=0x0, nFileSizeLow=0x5acb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKCfEqBglP.jpg", cAlternateFileName="DKCFEQ~1.JPG")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd1a910, ftCreationTime.dwHighDateTime=0x1d5eb95, ftLastAccessTime.dwLowDateTime=0xe5051050, ftLastAccessTime.dwHighDateTime=0x1d5ef89, ftLastWriteTime.dwLowDateTime=0xe5051050, ftLastWriteTime.dwHighDateTime=0x1d5ef89, nFileSizeHigh=0x0, nFileSizeLow=0x15670, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnES9puJGLTmbfl.jpg", cAlternateFileName="DNES9P~1.JPG")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73227680, ftCreationTime.dwHighDateTime=0x1d5ef9d, ftLastAccessTime.dwLowDateTime=0x12507ed0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0x12507ed0, ftLastWriteTime.dwHighDateTime=0x1d5e3a2, nFileSizeHigh=0x0, nFileSizeLow=0x121ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_PYESz.pptx", cAlternateFileName="E_PYES~1.PPT")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcfd2b0, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x5da4f800, ftLastAccessTime.dwHighDateTime=0x1d5ed40, ftLastWriteTime.dwLowDateTime=0x5da4f800, ftLastWriteTime.dwHighDateTime=0x1d5ed40, nFileSizeHigh=0x0, nFileSizeLow=0x11ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4QGiSQ-xLpo.csv", cAlternateFileName="F4QGIS~1.CSV")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e8000, ftCreationTime.dwHighDateTime=0x1d5ea18, ftLastAccessTime.dwLowDateTime=0x85204ae0, ftLastAccessTime.dwHighDateTime=0x1d5efdb, ftLastWriteTime.dwLowDateTime=0x85204ae0, ftLastWriteTime.dwHighDateTime=0x1d5efdb, nFileSizeHigh=0x0, nFileSizeLow=0x8f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="g471KyerOmcuRL fE5 B.jpg", cAlternateFileName="G471KY~1.JPG")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac1770, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x74f84280, ftLastAccessTime.dwHighDateTime=0x1d5f04e, ftLastWriteTime.dwLowDateTime=0x74f84280, ftLastWriteTime.dwHighDateTime=0x1d5f04e, nFileSizeHigh=0x0, nFileSizeLow=0xd8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glbxRUnvXcoLYQx2cpe.ppt", cAlternateFileName="GLBXRU~1.PPT")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e92f060, ftCreationTime.dwHighDateTime=0x1d5eaa1, ftLastAccessTime.dwLowDateTime=0x757af4b0, ftLastAccessTime.dwHighDateTime=0x1d5e224, ftLastWriteTime.dwLowDateTime=0x757af4b0, ftLastWriteTime.dwHighDateTime=0x1d5e224, nFileSizeHigh=0x0, nFileSizeLow=0x1411f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IddVn8dHRg5G5Fl.m4a", cAlternateFileName="IDDVN8~1.M4A")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f2c650, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0x6e2b5c10, ftLastAccessTime.dwHighDateTime=0x1d5eb64, ftLastWriteTime.dwLowDateTime=0x6e2b5c10, ftLastWriteTime.dwHighDateTime=0x1d5eb64, nFileSizeHigh=0x0, nFileSizeLow=0x7647, dwReserved0=0x0, dwReserved1=0x0, cFileName="Isc XPXB1.avi", cAlternateFileName="ISCXPX~1.AVI")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3c44e0, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0x9d36e680, ftLastAccessTime.dwHighDateTime=0x1d5e2b0, ftLastWriteTime.dwLowDateTime=0x9d36e680, ftLastWriteTime.dwHighDateTime=0x1d5e2b0, nFileSizeHigh=0x0, nFileSizeLow=0x911e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1LCP7NhdkCDO6.swf", cAlternateFileName="K1LCP7~1.SWF")) returned 1 [0049.012] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c370f0, ftCreationTime.dwHighDateTime=0x1d5e659, ftLastAccessTime.dwLowDateTime=0x2a30f260, ftLastAccessTime.dwHighDateTime=0x1d5eac7, ftLastWriteTime.dwLowDateTime=0x2a30f260, ftLastWriteTime.dwHighDateTime=0x1d5eac7, nFileSizeHigh=0x0, nFileSizeLow=0x4c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkgIaojIPpj245YHEisL.m4a", cAlternateFileName="KKGIAO~1.M4A")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3b23c0, ftCreationTime.dwHighDateTime=0x1d5e533, ftLastAccessTime.dwLowDateTime=0x1e865210, ftLastAccessTime.dwHighDateTime=0x1d5ed7a, ftLastWriteTime.dwLowDateTime=0x1e865210, ftLastWriteTime.dwHighDateTime=0x1d5ed7a, nFileSizeHigh=0x0, nFileSizeLow=0x18488, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ86MC1.mkv", cAlternateFileName="")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b00c00, ftCreationTime.dwHighDateTime=0x1d5e3c5, ftLastAccessTime.dwLowDateTime=0x38d75c10, ftLastAccessTime.dwHighDateTime=0x1d5e79c, ftLastWriteTime.dwLowDateTime=0x38d75c10, ftLastWriteTime.dwHighDateTime=0x1d5e79c, nFileSizeHigh=0x0, nFileSizeLow=0x82e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRuLz.doc", cAlternateFileName="")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a31870, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x4d2c2360, ftLastAccessTime.dwHighDateTime=0x1d5e988, ftLastWriteTime.dwLowDateTime=0x4d2c2360, ftLastWriteTime.dwHighDateTime=0x1d5e988, nFileSizeHigh=0x0, nFileSizeLow=0xf506, dwReserved0=0x0, dwReserved1=0x0, cFileName="kukoDO.mp4", cAlternateFileName="")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de15c00, ftCreationTime.dwHighDateTime=0x1d5e7ad, ftLastAccessTime.dwLowDateTime=0xfeebc000, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0xfeebc000, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x5d8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmSb.pptx", cAlternateFileName="MMSB~1.PPT")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7414480, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x994253e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0x994253e0, ftLastWriteTime.dwHighDateTime=0x1d5ed5d, nFileSizeHigh=0x0, nFileSizeLow=0xdef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MtjxaRpWiJUz-pMNd0.png", cAlternateFileName="MTJXAR~1.PNG")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e624df0, ftCreationTime.dwHighDateTime=0x1d5ee4c, ftLastAccessTime.dwLowDateTime=0xda19cee0, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xda19cee0, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc983, dwReserved0=0x0, dwReserved1=0x0, cFileName="OR_8lE.docx", cAlternateFileName="OR_8LE~1.DOC")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291179b0, ftCreationTime.dwHighDateTime=0x1d5e516, ftLastAccessTime.dwLowDateTime=0x4e53d750, ftLastAccessTime.dwHighDateTime=0x1d5e231, ftLastWriteTime.dwLowDateTime=0x4e53d750, ftLastWriteTime.dwHighDateTime=0x1d5e231, nFileSizeHigh=0x0, nFileSizeLow=0x140ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="phuiz_R3 PSU2JRxN.mp4", cAlternateFileName="PHUIZ_~1.MP4")) returned 1 [0049.013] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe73406d0, ftCreationTime.dwHighDateTime=0x1d5e5dc, ftLastAccessTime.dwLowDateTime=0x28a90b30, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0x28a90b30, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x103c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="qTJkG5.mp3", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58779ce0, ftCreationTime.dwHighDateTime=0x1d5e8bb, ftLastAccessTime.dwLowDateTime=0x44ee9040, ftLastAccessTime.dwHighDateTime=0x1d5e85f, ftLastWriteTime.dwLowDateTime=0x44ee9040, ftLastWriteTime.dwHighDateTime=0x1d5e85f, nFileSizeHigh=0x0, nFileSizeLow=0xc332, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsFq.mkv", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771eb780, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0xa5bff850, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0xa5bff850, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x83a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RZiwHrqcHk3rcIk02.rtf", cAlternateFileName="RZIWHR~1.RTF")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12194e50, ftCreationTime.dwHighDateTime=0x1d5f03c, ftLastAccessTime.dwLowDateTime=0x7ef5c9b0, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x7ef5c9b0, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xbc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="t o-Yt.mkv", cAlternateFileName="TO-YT~1.MKV")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbc79d0, ftCreationTime.dwHighDateTime=0x1d5e27e, ftLastAccessTime.dwLowDateTime=0xc0178ac0, ftLastAccessTime.dwHighDateTime=0x1d5ec1e, ftLastWriteTime.dwLowDateTime=0xc0178ac0, ftLastWriteTime.dwHighDateTime=0x1d5ec1e, nFileSizeHigh=0x0, nFileSizeLow=0xd320, dwReserved0=0x0, dwReserved1=0x0, cFileName="th_rcS.png", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd2ad00, ftCreationTime.dwHighDateTime=0x1d5ebb4, ftLastAccessTime.dwLowDateTime=0x21f0f3c0, ftLastAccessTime.dwHighDateTime=0x1d5e829, ftLastWriteTime.dwLowDateTime=0x21f0f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e829, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="U0nm5SQrqaR6r.gif", cAlternateFileName="U0NM5S~1.GIF")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb986c810, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x79cbb4a0, ftLastAccessTime.dwHighDateTime=0x1d5edbe, ftLastWriteTime.dwLowDateTime=0x79cbb4a0, ftLastWriteTime.dwHighDateTime=0x1d5edbe, nFileSizeHigh=0x0, nFileSizeLow=0x9546, dwReserved0=0x0, dwReserved1=0x0, cFileName="uXegZz.jpg", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4191a0, ftCreationTime.dwHighDateTime=0x1d5e9b4, ftLastAccessTime.dwLowDateTime=0x3f2a5d70, ftLastAccessTime.dwHighDateTime=0x1d5eb5b, ftLastWriteTime.dwLowDateTime=0x3f2a5d70, ftLastWriteTime.dwHighDateTime=0x1d5eb5b, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VbesvrI1.ots", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5be6e20, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xdb2f0e50, ftLastAccessTime.dwHighDateTime=0x1d5eafc, ftLastWriteTime.dwLowDateTime=0xdb2f0e50, ftLastWriteTime.dwHighDateTime=0x1d5eafc, nFileSizeHigh=0x0, nFileSizeLow=0x1353f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpQpDkI.wav", cAlternateFileName="")) returned 1 [0049.014] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vWbL6uc", cAlternateFileName="")) returned 1 [0049.015] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c6b140, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x84befc50, ftLastAccessTime.dwHighDateTime=0x1d5e1ca, ftLastWriteTime.dwLowDateTime=0x84befc50, ftLastWriteTime.dwHighDateTime=0x1d5e1ca, nFileSizeHigh=0x0, nFileSizeLow=0x2aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="y2rly3.png", cAlternateFileName="")) returned 1 [0049.015] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 1 [0049.015] FindNextFileW (in: hFindFile=0x169d4b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0049.015] FindClose (in: hFindFile=0x169d4b8 | out: hFindFile=0x169d4b8) returned 1 [0049.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0049.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0049.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0049.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0049.015] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce1114b3, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xce1114b3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d2b8 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xce1114b3, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xce1114b3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d20ca50, ftCreationTime.dwHighDateTime=0x1d5ea9c, ftLastAccessTime.dwLowDateTime=0x7bcc680, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0x7bcc680, ftLastWriteTime.dwHighDateTime=0x1d5e9a7, nFileSizeHigh=0x0, nFileSizeLow=0xe7f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oOWejWsgFpbJi.avi", cAlternateFileName="-OOWEJ~1.AVI")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a165d0, ftCreationTime.dwHighDateTime=0x1d5e7bd, ftLastAccessTime.dwLowDateTime=0x76ee69a0, ftLastAccessTime.dwHighDateTime=0x1d5e63c, ftLastWriteTime.dwLowDateTime=0x76ee69a0, ftLastWriteTime.dwHighDateTime=0x1d5e63c, nFileSizeHigh=0x0, nFileSizeLow=0x132d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Lu6NY1C.mp3", cAlternateFileName="")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b63d430, ftCreationTime.dwHighDateTime=0x1d5ee97, ftLastAccessTime.dwLowDateTime=0x2395340, ftLastAccessTime.dwHighDateTime=0x1d5e3fd, ftLastWriteTime.dwLowDateTime=0x2395340, ftLastWriteTime.dwHighDateTime=0x1d5e3fd, nFileSizeHigh=0x0, nFileSizeLow=0xbc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eS-i4hM.m4a", cAlternateFileName="")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa565a6d0, ftCreationTime.dwHighDateTime=0x1d5ed40, ftLastAccessTime.dwLowDateTime=0xfdf6750, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0xfdf6750, ftLastWriteTime.dwHighDateTime=0x1d5e0fb, nFileSizeHigh=0x0, nFileSizeLow=0x84e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="4phdci9dUrTtxEhd5.png", cAlternateFileName="4PHDCI~1.PNG")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abc90, ftCreationTime.dwHighDateTime=0x1d5eb9a, ftLastAccessTime.dwLowDateTime=0xf41c3f50, ftLastAccessTime.dwHighDateTime=0x1d5e84f, ftLastWriteTime.dwLowDateTime=0xf41c3f50, ftLastWriteTime.dwHighDateTime=0x1d5e84f, nFileSizeHigh=0x0, nFileSizeLow=0x15c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GZj_.ppt", cAlternateFileName="")) returned 1 [0049.016] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7582f5a0, ftCreationTime.dwHighDateTime=0x1d5e2c1, ftLastAccessTime.dwLowDateTime=0x660f05f0, ftLastAccessTime.dwHighDateTime=0x1d5ead2, ftLastWriteTime.dwLowDateTime=0x660f05f0, ftLastWriteTime.dwHighDateTime=0x1d5ead2, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XkMBpJLi1Me6-.odp", cAlternateFileName="6XKMBP~1.ODP")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf11700, ftCreationTime.dwHighDateTime=0x1d5e44f, ftLastAccessTime.dwLowDateTime=0x415e7d20, ftLastAccessTime.dwHighDateTime=0x1d5e619, ftLastWriteTime.dwLowDateTime=0x415e7d20, ftLastWriteTime.dwHighDateTime=0x1d5e619, nFileSizeHigh=0x0, nFileSizeLow=0xb474, dwReserved0=0x0, dwReserved1=0x0, cFileName="6YEj.gif", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcbcfc0, ftCreationTime.dwHighDateTime=0x1d5e4d5, ftLastAccessTime.dwLowDateTime=0xa7dac2a0, ftLastAccessTime.dwHighDateTime=0x1d5e215, ftLastWriteTime.dwLowDateTime=0xa7dac2a0, ftLastWriteTime.dwHighDateTime=0x1d5e215, nFileSizeHigh=0x0, nFileSizeLow=0x18577, dwReserved0=0x0, dwReserved1=0x0, cFileName="99M_21.mp4", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761effa0, ftCreationTime.dwHighDateTime=0x1d5e513, ftLastAccessTime.dwLowDateTime=0x8df58690, ftLastAccessTime.dwHighDateTime=0x1d5e6f2, ftLastWriteTime.dwLowDateTime=0x8df58690, ftLastWriteTime.dwHighDateTime=0x1d5e6f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aHL2OKuyfw1Y.flv", cAlternateFileName="AHL2OK~1.FLV")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f73ea0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x405c8f30, ftLastAccessTime.dwHighDateTime=0x1d5ecf8, ftLastWriteTime.dwLowDateTime=0x405c8f30, ftLastWriteTime.dwHighDateTime=0x1d5ecf8, nFileSizeHigh=0x0, nFileSizeLow=0xaebd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDIUES.wav", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4768d0, ftCreationTime.dwHighDateTime=0x1d5f042, ftLastAccessTime.dwLowDateTime=0x16351c30, ftLastAccessTime.dwHighDateTime=0x1d5e317, ftLastWriteTime.dwLowDateTime=0x16351c30, ftLastWriteTime.dwHighDateTime=0x1d5e317, nFileSizeHigh=0x0, nFileSizeLow=0x29e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BwCWt.swf", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4dc4150, ftCreationTime.dwHighDateTime=0x1d5eec1, ftLastAccessTime.dwLowDateTime=0x2a8d4660, ftLastAccessTime.dwHighDateTime=0x1d5ed3c, ftLastWriteTime.dwLowDateTime=0x2a8d4660, ftLastWriteTime.dwHighDateTime=0x1d5ed3c, nFileSizeHigh=0x0, nFileSizeLow=0x8d6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BzFCpK3sA5 wIqY9MGu.jpg", cAlternateFileName="BZFCPK~1.JPG")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.017] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bea64b0, ftCreationTime.dwHighDateTime=0x1d5ef3f, ftLastAccessTime.dwLowDateTime=0x65bfd110, ftLastAccessTime.dwHighDateTime=0x1d5e68b, ftLastWriteTime.dwLowDateTime=0x65bfd110, ftLastWriteTime.dwHighDateTime=0x1d5e68b, nFileSizeHigh=0x0, nFileSizeLow=0x5acb, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKCfEqBglP.jpg", cAlternateFileName="DKCFEQ~1.JPG")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd1a910, ftCreationTime.dwHighDateTime=0x1d5eb95, ftLastAccessTime.dwLowDateTime=0xe5051050, ftLastAccessTime.dwHighDateTime=0x1d5ef89, ftLastWriteTime.dwLowDateTime=0xe5051050, ftLastWriteTime.dwHighDateTime=0x1d5ef89, nFileSizeHigh=0x0, nFileSizeLow=0x15670, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnES9puJGLTmbfl.jpg", cAlternateFileName="DNES9P~1.JPG")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73227680, ftCreationTime.dwHighDateTime=0x1d5ef9d, ftLastAccessTime.dwLowDateTime=0x12507ed0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0x12507ed0, ftLastWriteTime.dwHighDateTime=0x1d5e3a2, nFileSizeHigh=0x0, nFileSizeLow=0x121ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_PYESz.pptx", cAlternateFileName="E_PYES~1.PPT")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcfd2b0, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x5da4f800, ftLastAccessTime.dwHighDateTime=0x1d5ed40, ftLastWriteTime.dwLowDateTime=0x5da4f800, ftLastWriteTime.dwHighDateTime=0x1d5ed40, nFileSizeHigh=0x0, nFileSizeLow=0x11ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4QGiSQ-xLpo.csv", cAlternateFileName="F4QGIS~1.CSV")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e8000, ftCreationTime.dwHighDateTime=0x1d5ea18, ftLastAccessTime.dwLowDateTime=0x85204ae0, ftLastAccessTime.dwHighDateTime=0x1d5efdb, ftLastWriteTime.dwLowDateTime=0x85204ae0, ftLastWriteTime.dwHighDateTime=0x1d5efdb, nFileSizeHigh=0x0, nFileSizeLow=0x8f1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="g471KyerOmcuRL fE5 B.jpg", cAlternateFileName="G471KY~1.JPG")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac1770, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x74f84280, ftLastAccessTime.dwHighDateTime=0x1d5f04e, ftLastWriteTime.dwLowDateTime=0x74f84280, ftLastWriteTime.dwHighDateTime=0x1d5f04e, nFileSizeHigh=0x0, nFileSizeLow=0xd8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glbxRUnvXcoLYQx2cpe.ppt", cAlternateFileName="GLBXRU~1.PPT")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e92f060, ftCreationTime.dwHighDateTime=0x1d5eaa1, ftLastAccessTime.dwLowDateTime=0x757af4b0, ftLastAccessTime.dwHighDateTime=0x1d5e224, ftLastWriteTime.dwLowDateTime=0x757af4b0, ftLastWriteTime.dwHighDateTime=0x1d5e224, nFileSizeHigh=0x0, nFileSizeLow=0x1411f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IddVn8dHRg5G5Fl.m4a", cAlternateFileName="IDDVN8~1.M4A")) returned 1 [0049.018] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f2c650, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0x6e2b5c10, ftLastAccessTime.dwHighDateTime=0x1d5eb64, ftLastWriteTime.dwLowDateTime=0x6e2b5c10, ftLastWriteTime.dwHighDateTime=0x1d5eb64, nFileSizeHigh=0x0, nFileSizeLow=0x7647, dwReserved0=0x0, dwReserved1=0x0, cFileName="Isc XPXB1.avi", cAlternateFileName="ISCXPX~1.AVI")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3c44e0, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0x9d36e680, ftLastAccessTime.dwHighDateTime=0x1d5e2b0, ftLastWriteTime.dwLowDateTime=0x9d36e680, ftLastWriteTime.dwHighDateTime=0x1d5e2b0, nFileSizeHigh=0x0, nFileSizeLow=0x911e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1LCP7NhdkCDO6.swf", cAlternateFileName="K1LCP7~1.SWF")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c370f0, ftCreationTime.dwHighDateTime=0x1d5e659, ftLastAccessTime.dwLowDateTime=0x2a30f260, ftLastAccessTime.dwHighDateTime=0x1d5eac7, ftLastWriteTime.dwLowDateTime=0x2a30f260, ftLastWriteTime.dwHighDateTime=0x1d5eac7, nFileSizeHigh=0x0, nFileSizeLow=0x4c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkgIaojIPpj245YHEisL.m4a", cAlternateFileName="KKGIAO~1.M4A")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3b23c0, ftCreationTime.dwHighDateTime=0x1d5e533, ftLastAccessTime.dwLowDateTime=0x1e865210, ftLastAccessTime.dwHighDateTime=0x1d5ed7a, ftLastWriteTime.dwLowDateTime=0x1e865210, ftLastWriteTime.dwHighDateTime=0x1d5ed7a, nFileSizeHigh=0x0, nFileSizeLow=0x18488, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ86MC1.mkv", cAlternateFileName="")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b00c00, ftCreationTime.dwHighDateTime=0x1d5e3c5, ftLastAccessTime.dwLowDateTime=0x38d75c10, ftLastAccessTime.dwHighDateTime=0x1d5e79c, ftLastWriteTime.dwLowDateTime=0x38d75c10, ftLastWriteTime.dwHighDateTime=0x1d5e79c, nFileSizeHigh=0x0, nFileSizeLow=0x82e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRuLz.doc", cAlternateFileName="")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a31870, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x4d2c2360, ftLastAccessTime.dwHighDateTime=0x1d5e988, ftLastWriteTime.dwLowDateTime=0x4d2c2360, ftLastWriteTime.dwHighDateTime=0x1d5e988, nFileSizeHigh=0x0, nFileSizeLow=0xf506, dwReserved0=0x0, dwReserved1=0x0, cFileName="kukoDO.mp4", cAlternateFileName="")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de15c00, ftCreationTime.dwHighDateTime=0x1d5e7ad, ftLastAccessTime.dwLowDateTime=0xfeebc000, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0xfeebc000, ftLastWriteTime.dwHighDateTime=0x1d5e1b9, nFileSizeHigh=0x0, nFileSizeLow=0x5d8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmSb.pptx", cAlternateFileName="MMSB~1.PPT")) returned 1 [0049.019] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7414480, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x994253e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0x994253e0, ftLastWriteTime.dwHighDateTime=0x1d5ed5d, nFileSizeHigh=0x0, nFileSizeLow=0xdef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MtjxaRpWiJUz-pMNd0.png", cAlternateFileName="MTJXAR~1.PNG")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e624df0, ftCreationTime.dwHighDateTime=0x1d5ee4c, ftLastAccessTime.dwLowDateTime=0xda19cee0, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xda19cee0, ftLastWriteTime.dwHighDateTime=0x1d5e216, nFileSizeHigh=0x0, nFileSizeLow=0xc983, dwReserved0=0x0, dwReserved1=0x0, cFileName="OR_8lE.docx", cAlternateFileName="OR_8LE~1.DOC")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291179b0, ftCreationTime.dwHighDateTime=0x1d5e516, ftLastAccessTime.dwLowDateTime=0x4e53d750, ftLastAccessTime.dwHighDateTime=0x1d5e231, ftLastWriteTime.dwLowDateTime=0x4e53d750, ftLastWriteTime.dwHighDateTime=0x1d5e231, nFileSizeHigh=0x0, nFileSizeLow=0x140ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="phuiz_R3 PSU2JRxN.mp4", cAlternateFileName="PHUIZ_~1.MP4")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe73406d0, ftCreationTime.dwHighDateTime=0x1d5e5dc, ftLastAccessTime.dwLowDateTime=0x28a90b30, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0x28a90b30, ftLastWriteTime.dwHighDateTime=0x1d5e2b6, nFileSizeHigh=0x0, nFileSizeLow=0x103c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="qTJkG5.mp3", cAlternateFileName="")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58779ce0, ftCreationTime.dwHighDateTime=0x1d5e8bb, ftLastAccessTime.dwLowDateTime=0x44ee9040, ftLastAccessTime.dwHighDateTime=0x1d5e85f, ftLastWriteTime.dwLowDateTime=0x44ee9040, ftLastWriteTime.dwHighDateTime=0x1d5e85f, nFileSizeHigh=0x0, nFileSizeLow=0xc332, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsFq.mkv", cAlternateFileName="")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771eb780, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0xa5bff850, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0xa5bff850, ftLastWriteTime.dwHighDateTime=0x1d5e4db, nFileSizeHigh=0x0, nFileSizeLow=0x83a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="RZiwHrqcHk3rcIk02.rtf", cAlternateFileName="RZIWHR~1.RTF")) returned 1 [0049.020] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12194e50, ftCreationTime.dwHighDateTime=0x1d5f03c, ftLastAccessTime.dwLowDateTime=0x7ef5c9b0, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0x7ef5c9b0, ftLastWriteTime.dwHighDateTime=0x1d5e153, nFileSizeHigh=0x0, nFileSizeLow=0xbc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="t o-Yt.mkv", cAlternateFileName="TO-YT~1.MKV")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbc79d0, ftCreationTime.dwHighDateTime=0x1d5e27e, ftLastAccessTime.dwLowDateTime=0xc0178ac0, ftLastAccessTime.dwHighDateTime=0x1d5ec1e, ftLastWriteTime.dwLowDateTime=0xc0178ac0, ftLastWriteTime.dwHighDateTime=0x1d5ec1e, nFileSizeHigh=0x0, nFileSizeLow=0xd320, dwReserved0=0x0, dwReserved1=0x0, cFileName="th_rcS.png", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd2ad00, ftCreationTime.dwHighDateTime=0x1d5ebb4, ftLastAccessTime.dwLowDateTime=0x21f0f3c0, ftLastAccessTime.dwHighDateTime=0x1d5e829, ftLastWriteTime.dwLowDateTime=0x21f0f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e829, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="U0nm5SQrqaR6r.gif", cAlternateFileName="U0NM5S~1.GIF")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb986c810, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x79cbb4a0, ftLastAccessTime.dwHighDateTime=0x1d5edbe, ftLastWriteTime.dwLowDateTime=0x79cbb4a0, ftLastWriteTime.dwHighDateTime=0x1d5edbe, nFileSizeHigh=0x0, nFileSizeLow=0x9546, dwReserved0=0x0, dwReserved1=0x0, cFileName="uXegZz.jpg", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4191a0, ftCreationTime.dwHighDateTime=0x1d5e9b4, ftLastAccessTime.dwLowDateTime=0x3f2a5d70, ftLastAccessTime.dwHighDateTime=0x1d5eb5b, ftLastWriteTime.dwLowDateTime=0x3f2a5d70, ftLastWriteTime.dwHighDateTime=0x1d5eb5b, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VbesvrI1.ots", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5be6e20, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xdb2f0e50, ftLastAccessTime.dwHighDateTime=0x1d5eafc, ftLastWriteTime.dwLowDateTime=0xdb2f0e50, ftLastWriteTime.dwHighDateTime=0x1d5eafc, nFileSizeHigh=0x0, nFileSizeLow=0x1353f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpQpDkI.wav", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vWbL6uc", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c6b140, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x84befc50, ftLastAccessTime.dwHighDateTime=0x1d5e1ca, ftLastWriteTime.dwLowDateTime=0x84befc50, ftLastWriteTime.dwHighDateTime=0x1d5e1ca, nFileSizeHigh=0x0, nFileSizeLow=0x2aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="y2rly3.png", cAlternateFileName="")) returned 1 [0049.021] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 1 [0049.022] FindNextFileW (in: hFindFile=0x169d2b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 0 [0049.022] FindClose (in: hFindFile=0x169d2b8 | out: hFindFile=0x169d2b8) returned 1 [0049.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0049.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0049.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", lpFilePart=0x0) returned 0x2a [0049.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0049.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-oowejwsgfpbji.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0049.043] GetFileType (hFile=0x350) returned 0x1 [0049.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0049.043] GetFileType (hFile=0x350) returned 0x1 [0049.044] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xe7f3 [0049.045] ReadFile (in: hFile=0x350, lpBuffer=0x32beadc, nNumberOfBytesToRead=0xe7f3, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32beadc*, lpNumberOfBytesRead=0x138e7fc*=0xe7f3, lpOverlapped=0x0) returned 1 [0049.045] CloseHandle (hObject=0x350) returned 1 [0052.567] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x138e1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0052.567] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x138e208, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0052.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6bc) returned 1 [0052.568] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x138e738 | out: lpFileInformation=0x138e738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0052.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6b8) returned 1 [0052.811] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x138e614 | out: pfEnabled=0x138e614) returned 0x0 [0053.217] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", lpFilePart=0x0) returned 0x2a [0053.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-oowejwsgfpbji.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0053.219] GetFileType (hFile=0x3fc) returned 0x1 [0053.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.220] GetFileType (hFile=0x3fc) returned 0x1 [0053.220] WriteFile (in: hFile=0x3fc, lpBuffer=0x33614d4*, nNumberOfBytesToWrite=0xe800, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33614d4*, lpNumberOfBytesWritten=0x138e7f0*=0xe800, lpOverlapped=0x0) returned 1 [0053.222] CloseHandle (hObject=0x3fc) returned 1 [0053.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi", lpFilePart=0x0) returned 0x2a [0053.225] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi.a", lpFilePart=0x0) returned 0x2c [0053.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-oowejwsgfpbji.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d20ca50, ftCreationTime.dwHighDateTime=0x1d5ea9c, ftLastAccessTime.dwLowDateTime=0x7bcc680, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0xd0abc7ae, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe800)) returned 1 [0053.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.225] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\-oowejwsgfpbji.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-oOWejWsgFpbJi.avi.a" (normalized: "c:\\users\\fd1hvy\\desktop\\-oowejwsgfpbji.avi.a")) returned 1 [0053.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", lpFilePart=0x0) returned 0x24 [0053.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3lu6ny1c.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0053.226] GetFileType (hFile=0x3fc) returned 0x1 [0053.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.226] GetFileType (hFile=0x3fc) returned 0x1 [0053.226] GetFileSize (in: hFile=0x3fc, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x132d1 [0053.228] ReadFile (in: hFile=0x3fc, lpBuffer=0x33700f4, nNumberOfBytesToRead=0x132d1, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33700f4*, lpNumberOfBytesRead=0x138e7fc*=0x132d1, lpOverlapped=0x0) returned 1 [0053.228] CloseHandle (hObject=0x3fc) returned 1 [0053.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", lpFilePart=0x0) returned 0x24 [0053.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3lu6ny1c.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0053.491] GetFileType (hFile=0x3fc) returned 0x1 [0053.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.491] GetFileType (hFile=0x3fc) returned 0x1 [0053.491] WriteFile (in: hFile=0x3fc, lpBuffer=0x33f6794*, nNumberOfBytesToWrite=0x132e0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f6794*, lpNumberOfBytesWritten=0x138e7f0*=0x132e0, lpOverlapped=0x0) returned 1 [0053.493] CloseHandle (hObject=0x3fc) returned 1 [0053.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3", lpFilePart=0x0) returned 0x24 [0053.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3.a", lpFilePart=0x0) returned 0x26 [0053.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3lu6ny1c.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a165d0, ftCreationTime.dwHighDateTime=0x1d5e7bd, ftLastAccessTime.dwLowDateTime=0x76ee69a0, ftLastAccessTime.dwHighDateTime=0x1d5e63c, ftLastWriteTime.dwLowDateTime=0xd0d45253, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x132e0)) returned 1 [0053.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.569] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\3lu6ny1c.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\3Lu6NY1C.mp3.a" (normalized: "c:\\users\\fd1hvy\\desktop\\3lu6ny1c.mp3.a")) returned 1 [0053.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", lpFilePart=0x0) returned 0x2d [0053.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\4phdci9durttxehd5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3fc [0053.570] GetFileType (hFile=0x3fc) returned 0x1 [0053.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.570] GetFileType (hFile=0x3fc) returned 0x1 [0053.570] GetFileSize (in: hFile=0x3fc, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x84e4 [0053.571] ReadFile (in: hFile=0x3fc, lpBuffer=0x3409e90, nNumberOfBytesToRead=0x84e4, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3409e90*, lpNumberOfBytesRead=0x138e7fc*=0x84e4, lpOverlapped=0x0) returned 1 [0053.571] CloseHandle (hObject=0x3fc) returned 1 [0053.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", lpFilePart=0x0) returned 0x2d [0053.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.675] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\4phdci9durttxehd5.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.676] GetFileType (hFile=0x2e4) returned 0x1 [0053.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.676] GetFileType (hFile=0x2e4) returned 0x1 [0053.676] WriteFile (in: hFile=0x2e4, lpBuffer=0x32b40bc*, nNumberOfBytesToWrite=0x84f0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32b40bc*, lpNumberOfBytesWritten=0x138e7f0*=0x84f0, lpOverlapped=0x0) returned 1 [0053.678] CloseHandle (hObject=0x2e4) returned 1 [0053.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png", lpFilePart=0x0) returned 0x2d [0053.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png.a", lpFilePart=0x0) returned 0x2f [0053.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\4phdci9durttxehd5.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa565a6d0, ftCreationTime.dwHighDateTime=0x1d5ed40, ftLastAccessTime.dwLowDateTime=0xfdf6750, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0xd0f0eee3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x84f0)) returned 1 [0053.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.699] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png" (normalized: "c:\\users\\fd1hvy\\desktop\\4phdci9durttxehd5.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4phdci9dUrTtxEhd5.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\4phdci9durttxehd5.png.a")) returned 1 [0053.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", lpFilePart=0x0) returned 0x21 [0053.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\6gzj_.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.700] GetFileType (hFile=0x2e4) returned 0x1 [0053.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.700] GetFileType (hFile=0x2e4) returned 0x1 [0053.700] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x15c61 [0053.700] ReadFile (in: hFile=0x2e4, lpBuffer=0x42fbf10, nNumberOfBytesToRead=0x15c61, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x42fbf10*, lpNumberOfBytesRead=0x138e7fc*=0x15c61, lpOverlapped=0x0) returned 1 [0053.702] CloseHandle (hObject=0x2e4) returned 1 [0053.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", lpFilePart=0x0) returned 0x21 [0053.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\6gzj_.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.727] GetFileType (hFile=0x2e4) returned 0x1 [0053.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.727] GetFileType (hFile=0x2e4) returned 0x1 [0053.727] WriteFile (in: hFile=0x2e4, lpBuffer=0x4368d70*, nNumberOfBytesToWrite=0x15c70, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x4368d70*, lpNumberOfBytesWritten=0x138e7f0*=0x15c70, lpOverlapped=0x0) returned 1 [0053.772] CloseHandle (hObject=0x2e4) returned 1 [0053.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt", lpFilePart=0x0) returned 0x21 [0053.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt.a", lpFilePart=0x0) returned 0x23 [0053.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.775] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\6gzj_.ppt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abc90, ftCreationTime.dwHighDateTime=0x1d5eb9a, ftLastAccessTime.dwLowDateTime=0xf41c3f50, ftLastAccessTime.dwHighDateTime=0x1d5e84f, ftLastWriteTime.dwLowDateTime=0xd0ff3c93, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15c70)) returned 1 [0053.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.775] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\6gzj_.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6GZj_.ppt.a" (normalized: "c:\\users\\fd1hvy\\desktop\\6gzj_.ppt.a")) returned 1 [0053.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", lpFilePart=0x0) returned 0x22 [0053.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\99m_21.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.776] GetFileType (hFile=0x2e4) returned 0x1 [0053.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.776] GetFileType (hFile=0x2e4) returned 0x1 [0053.776] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x18577 [0053.776] ReadFile (in: hFile=0x2e4, lpBuffer=0x437ea00, nNumberOfBytesToRead=0x18577, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x437ea00*, lpNumberOfBytesRead=0x138e7fc*=0x18577, lpOverlapped=0x0) returned 1 [0053.787] CloseHandle (hObject=0x2e4) returned 1 [0053.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.825] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.825] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", lpFilePart=0x0) returned 0x22 [0053.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.825] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\99m_21.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.827] GetFileType (hFile=0x2e4) returned 0x1 [0053.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.827] GetFileType (hFile=0x2e4) returned 0x1 [0053.827] WriteFile (in: hFile=0x2e4, lpBuffer=0x43f85b8*, nNumberOfBytesToWrite=0x18580, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x43f85b8*, lpNumberOfBytesWritten=0x138e7f0*=0x18580, lpOverlapped=0x0) returned 1 [0053.829] CloseHandle (hObject=0x2e4) returned 1 [0053.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4", lpFilePart=0x0) returned 0x22 [0053.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4.a", lpFilePart=0x0) returned 0x24 [0053.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\99m_21.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcbcfc0, ftCreationTime.dwHighDateTime=0x1d5e4d5, ftLastAccessTime.dwLowDateTime=0xa7dac2a0, ftLastAccessTime.dwHighDateTime=0x1d5e215, ftLastWriteTime.dwLowDateTime=0xd108c5eb, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18580)) returned 1 [0053.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.832] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\99m_21.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\99M_21.mp4.a" (normalized: "c:\\users\\fd1hvy\\desktop\\99m_21.mp4.a")) returned 1 [0053.832] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", lpFilePart=0x0) returned 0x2f [0053.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\bzfcpk3sa5 wiqy9mgu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.833] GetFileType (hFile=0x2e4) returned 0x1 [0053.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.833] GetFileType (hFile=0x2e4) returned 0x1 [0053.833] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x8d6e [0053.833] ReadFile (in: hFile=0x2e4, lpBuffer=0x3356f44, nNumberOfBytesToRead=0x8d6e, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3356f44*, lpNumberOfBytesRead=0x138e7fc*=0x8d6e, lpOverlapped=0x0) returned 1 [0053.833] CloseHandle (hObject=0x2e4) returned 1 [0053.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", lpFilePart=0x0) returned 0x2f [0053.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.866] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\bzfcpk3sa5 wiqy9mgu.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.867] GetFileType (hFile=0x2e4) returned 0x1 [0053.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.867] GetFileType (hFile=0x2e4) returned 0x1 [0053.868] WriteFile (in: hFile=0x2e4, lpBuffer=0x33d0060*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33d0060*, lpNumberOfBytesWritten=0x138e7f0*=0x8d70, lpOverlapped=0x0) returned 1 [0053.869] CloseHandle (hObject=0x2e4) returned 1 [0053.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg", lpFilePart=0x0) returned 0x2f [0053.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg.a", lpFilePart=0x0) returned 0x31 [0053.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\bzfcpk3sa5 wiqy9mgu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4dc4150, ftCreationTime.dwHighDateTime=0x1d5eec1, ftLastAccessTime.dwLowDateTime=0x2a8d4660, ftLastAccessTime.dwHighDateTime=0x1d5ed3c, ftLastWriteTime.dwLowDateTime=0xd10d8a52, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8d70)) returned 1 [0053.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.870] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\bzfcpk3sa5 wiqy9mgu.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BzFCpK3sA5 wIqY9MGu.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\bzfcpk3sa5 wiqy9mgu.jpg.a")) returned 1 [0053.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", lpFilePart=0x0) returned 0x26 [0053.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dkcfeqbglp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.871] GetFileType (hFile=0x2e4) returned 0x1 [0053.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.872] GetFileType (hFile=0x2e4) returned 0x1 [0053.872] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x5acb [0053.872] ReadFile (in: hFile=0x2e4, lpBuffer=0x33d9238, nNumberOfBytesToRead=0x5acb, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33d9238*, lpNumberOfBytesRead=0x138e7fc*=0x5acb, lpOverlapped=0x0) returned 1 [0053.872] CloseHandle (hObject=0x2e4) returned 1 [0053.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.889] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", lpFilePart=0x0) returned 0x26 [0053.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dkcfeqbglp.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.890] GetFileType (hFile=0x2e4) returned 0x1 [0053.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.890] GetFileType (hFile=0x2e4) returned 0x1 [0053.890] WriteFile (in: hFile=0x2e4, lpBuffer=0x3442634*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3442634*, lpNumberOfBytesWritten=0x138e7f0*=0x5ad0, lpOverlapped=0x0) returned 1 [0053.891] CloseHandle (hObject=0x2e4) returned 1 [0053.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg", lpFilePart=0x0) returned 0x26 [0053.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg.a", lpFilePart=0x0) returned 0x28 [0053.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.892] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dkcfeqbglp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bea64b0, ftCreationTime.dwHighDateTime=0x1d5ef3f, ftLastAccessTime.dwLowDateTime=0x65bfd110, ftLastAccessTime.dwHighDateTime=0x1d5e68b, ftLastWriteTime.dwLowDateTime=0xd1124e6a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5ad0)) returned 1 [0053.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.892] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dkcfeqbglp.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dKCfEqBglP.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\dkcfeqbglp.jpg.a")) returned 1 [0053.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", lpFilePart=0x0) returned 0x2b [0053.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dnes9pujgltmbfl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.893] GetFileType (hFile=0x2e4) returned 0x1 [0053.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.893] GetFileType (hFile=0x2e4) returned 0x1 [0053.893] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x15670 [0053.894] ReadFile (in: hFile=0x2e4, lpBuffer=0x4410b58, nNumberOfBytesToRead=0x15670, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x4410b58*, lpNumberOfBytesRead=0x138e7fc*=0x15670, lpOverlapped=0x0) returned 1 [0053.895] CloseHandle (hObject=0x2e4) returned 1 [0053.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", lpFilePart=0x0) returned 0x2b [0053.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dnes9pujgltmbfl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.945] GetFileType (hFile=0x2e4) returned 0x1 [0053.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.945] GetFileType (hFile=0x2e4) returned 0x1 [0053.945] WriteFile (in: hFile=0x2e4, lpBuffer=0x447bc08*, nNumberOfBytesToWrite=0x15680, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x447bc08*, lpNumberOfBytesWritten=0x138e7f0*=0x15680, lpOverlapped=0x0) returned 1 [0053.947] CloseHandle (hObject=0x2e4) returned 1 [0053.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg", lpFilePart=0x0) returned 0x2b [0053.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg.a", lpFilePart=0x0) returned 0x2d [0053.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dnes9pujgltmbfl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd1a910, ftCreationTime.dwHighDateTime=0x1d5eb95, ftLastAccessTime.dwLowDateTime=0xe5051050, ftLastAccessTime.dwHighDateTime=0x1d5ef89, ftLastWriteTime.dwLowDateTime=0xd119b925, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15680)) returned 1 [0053.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.950] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\dnes9pujgltmbfl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\DnES9puJGLTmbfl.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\dnes9pujgltmbfl.jpg.a")) returned 1 [0053.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", lpFilePart=0x0) returned 0x24 [0053.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\e_pyesz.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.950] GetFileType (hFile=0x2e4) returned 0x1 [0053.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.951] GetFileType (hFile=0x2e4) returned 0x1 [0053.951] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x121ac [0053.953] ReadFile (in: hFile=0x2e4, lpBuffer=0x3495730, nNumberOfBytesToRead=0x121ac, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3495730*, lpNumberOfBytesRead=0x138e7fc*=0x121ac, lpOverlapped=0x0) returned 1 [0053.954] CloseHandle (hObject=0x2e4) returned 1 [0053.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0053.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0053.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0053.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0053.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", lpFilePart=0x0) returned 0x24 [0053.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0053.991] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\e_pyesz.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.992] GetFileType (hFile=0x2e4) returned 0x1 [0053.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0053.992] GetFileType (hFile=0x2e4) returned 0x1 [0053.992] WriteFile (in: hFile=0x2e4, lpBuffer=0x3518a3c*, nNumberOfBytesToWrite=0x121b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3518a3c*, lpNumberOfBytesWritten=0x138e7f0*=0x121b0, lpOverlapped=0x0) returned 1 [0053.994] CloseHandle (hObject=0x2e4) returned 1 [0053.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx", lpFilePart=0x0) returned 0x24 [0053.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx.a", lpFilePart=0x0) returned 0x26 [0053.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0053.998] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\e_pyesz.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73227680, ftCreationTime.dwHighDateTime=0x1d5ef9d, ftLastAccessTime.dwLowDateTime=0x12507ed0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0xd120e059, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x121b0)) returned 1 [0053.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0053.998] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\e_pyesz.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\E_PYESz.pptx.a" (normalized: "c:\\users\\fd1hvy\\desktop\\e_pyesz.pptx.a")) returned 1 [0053.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", lpFilePart=0x0) returned 0x28 [0053.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0053.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\f4qgisq-xlpo.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0053.999] GetFileType (hFile=0x2e4) returned 0x1 [0053.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0053.999] GetFileType (hFile=0x2e4) returned 0x1 [0053.999] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x11ac [0054.000] ReadFile (in: hFile=0x2e4, lpBuffer=0x352afe0, nNumberOfBytesToRead=0x11ac, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x352afe0*, lpNumberOfBytesRead=0x138e7fc*=0x11ac, lpOverlapped=0x0) returned 1 [0054.000] CloseHandle (hObject=0x2e4) returned 1 [0054.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", lpFilePart=0x0) returned 0x28 [0054.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.025] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\f4qgisq-xlpo.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.026] GetFileType (hFile=0x2e4) returned 0x1 [0054.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.026] GetFileType (hFile=0x2e4) returned 0x1 [0054.026] WriteFile (in: hFile=0x2e4, lpBuffer=0x357d638*, nNumberOfBytesToWrite=0x11b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x357d638*, lpNumberOfBytesWritten=0x138e7f0*=0x11b0, lpOverlapped=0x0) returned 1 [0054.027] CloseHandle (hObject=0x2e4) returned 1 [0054.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv", lpFilePart=0x0) returned 0x28 [0054.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv.a", lpFilePart=0x0) returned 0x2a [0054.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\f4qgisq-xlpo.csv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcfd2b0, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x5da4f800, ftLastAccessTime.dwHighDateTime=0x1d5ed40, ftLastWriteTime.dwLowDateTime=0xd125a71a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11b0)) returned 1 [0054.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.028] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\f4qgisq-xlpo.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\f4QGiSQ-xLpo.csv.a" (normalized: "c:\\users\\fd1hvy\\desktop\\f4qgisq-xlpo.csv.a")) returned 1 [0054.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", lpFilePart=0x0) returned 0x30 [0054.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\g471kyeromcurl fe5 b.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.029] GetFileType (hFile=0x2e4) returned 0x1 [0054.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.029] GetFileType (hFile=0x2e4) returned 0x1 [0054.029] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x8f1b [0054.030] ReadFile (in: hFile=0x2e4, lpBuffer=0x357ec24, nNumberOfBytesToRead=0x8f1b, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x357ec24*, lpNumberOfBytesRead=0x138e7fc*=0x8f1b, lpOverlapped=0x0) returned 1 [0054.030] CloseHandle (hObject=0x2e4) returned 1 [0054.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", lpFilePart=0x0) returned 0x30 [0054.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\g471kyeromcurl fe5 b.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.056] GetFileType (hFile=0x2e4) returned 0x1 [0054.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.056] GetFileType (hFile=0x2e4) returned 0x1 [0054.057] WriteFile (in: hFile=0x2e4, lpBuffer=0x35f85b0*, nNumberOfBytesToWrite=0x8f20, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x35f85b0*, lpNumberOfBytesWritten=0x138e7f0*=0x8f20, lpOverlapped=0x0) returned 1 [0054.058] CloseHandle (hObject=0x2e4) returned 1 [0054.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg", lpFilePart=0x0) returned 0x30 [0054.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg.a", lpFilePart=0x0) returned 0x32 [0054.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\g471kyeromcurl fe5 b.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e8000, ftCreationTime.dwHighDateTime=0x1d5ea18, ftLastAccessTime.dwLowDateTime=0x85204ae0, ftLastAccessTime.dwHighDateTime=0x1d5efdb, ftLastWriteTime.dwLowDateTime=0xd12a6c28, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8f20)) returned 1 [0054.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.059] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\g471kyeromcurl fe5 b.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\g471KyerOmcuRL fE5 B.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\g471kyeromcurl fe5 b.jpg.a")) returned 1 [0054.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", lpFilePart=0x0) returned 0x2f [0054.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\glbxrunvxcolyqx2cpe.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.060] GetFileType (hFile=0x2e4) returned 0x1 [0054.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.085] GetFileType (hFile=0x2e4) returned 0x1 [0054.085] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xd8a0 [0054.086] ReadFile (in: hFile=0x2e4, lpBuffer=0x3601954, nNumberOfBytesToRead=0xd8a0, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3601954*, lpNumberOfBytesRead=0x138e7fc*=0xd8a0, lpOverlapped=0x0) returned 1 [0054.086] CloseHandle (hObject=0x2e4) returned 1 [0054.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", lpFilePart=0x0) returned 0x2f [0054.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\glbxrunvxcolyqx2cpe.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.151] GetFileType (hFile=0x2e4) returned 0x1 [0054.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.151] GetFileType (hFile=0x2e4) returned 0x1 [0054.151] WriteFile (in: hFile=0x2e4, lpBuffer=0x32a3294*, nNumberOfBytesToWrite=0xd8b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32a3294*, lpNumberOfBytesWritten=0x138e7f0*=0xd8b0, lpOverlapped=0x0) returned 1 [0054.153] CloseHandle (hObject=0x2e4) returned 1 [0054.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt", lpFilePart=0x0) returned 0x2f [0054.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt.a", lpFilePart=0x0) returned 0x31 [0054.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\glbxrunvxcolyqx2cpe.ppt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac1770, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x74f84280, ftLastAccessTime.dwHighDateTime=0x1d5f04e, ftLastWriteTime.dwLowDateTime=0xd13b2fa4, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0)) returned 1 [0054.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.162] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\glbxrunvxcolyqx2cpe.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\glbxRUnvXcoLYQx2cpe.ppt.a" (normalized: "c:\\users\\fd1hvy\\desktop\\glbxrunvxcolyqx2cpe.ppt.a")) returned 1 [0054.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", lpFilePart=0x0) returned 0x25 [0054.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\isc xpxb1.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.162] GetFileType (hFile=0x2e4) returned 0x1 [0054.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.162] GetFileType (hFile=0x2e4) returned 0x1 [0054.162] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x7647 [0054.162] ReadFile (in: hFile=0x2e4, lpBuffer=0x32b0fb0, nNumberOfBytesToRead=0x7647, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32b0fb0*, lpNumberOfBytesRead=0x138e7fc*=0x7647, lpOverlapped=0x0) returned 1 [0054.163] CloseHandle (hObject=0x2e4) returned 1 [0054.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.223] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", lpFilePart=0x0) returned 0x25 [0054.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.224] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\isc xpxb1.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.225] GetFileType (hFile=0x2e4) returned 0x1 [0054.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.225] GetFileType (hFile=0x2e4) returned 0x1 [0054.225] WriteFile (in: hFile=0x2e4, lpBuffer=0x3322e88*, nNumberOfBytesToWrite=0x7650, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3322e88*, lpNumberOfBytesWritten=0x138e7f0*=0x7650, lpOverlapped=0x0) returned 1 [0054.226] CloseHandle (hObject=0x2e4) returned 1 [0054.227] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi", lpFilePart=0x0) returned 0x25 [0054.227] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi.a", lpFilePart=0x0) returned 0x27 [0054.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\isc xpxb1.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f2c650, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0x6e2b5c10, ftLastAccessTime.dwHighDateTime=0x1d5eb64, ftLastWriteTime.dwLowDateTime=0xd144a5fd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x7650)) returned 1 [0054.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.228] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\isc xpxb1.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Isc XPXB1.avi.a" (normalized: "c:\\users\\fd1hvy\\desktop\\isc xpxb1.avi.a")) returned 1 [0054.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", lpFilePart=0x0) returned 0x23 [0054.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\kq86mc1.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.228] GetFileType (hFile=0x2e4) returned 0x1 [0054.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.228] GetFileType (hFile=0x2e4) returned 0x1 [0054.228] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x18488 [0054.229] ReadFile (in: hFile=0x2e4, lpBuffer=0x44d0768, nNumberOfBytesToRead=0x18488, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x44d0768*, lpNumberOfBytesRead=0x138e7fc*=0x18488, lpOverlapped=0x0) returned 1 [0054.231] CloseHandle (hObject=0x2e4) returned 1 [0054.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", lpFilePart=0x0) returned 0x23 [0054.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\kq86mc1.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.256] GetFileType (hFile=0x2e4) returned 0x1 [0054.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.256] GetFileType (hFile=0x2e4) returned 0x1 [0054.256] WriteFile (in: hFile=0x2e4, lpBuffer=0x4549e70*, nNumberOfBytesToWrite=0x18490, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x4549e70*, lpNumberOfBytesWritten=0x138e7f0*=0x18490, lpOverlapped=0x0) returned 1 [0054.260] CloseHandle (hObject=0x2e4) returned 1 [0054.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv", lpFilePart=0x0) returned 0x23 [0054.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv.a", lpFilePart=0x0) returned 0x25 [0054.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.262] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\kq86mc1.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3b23c0, ftCreationTime.dwHighDateTime=0x1d5e533, ftLastAccessTime.dwLowDateTime=0x1e865210, ftLastAccessTime.dwHighDateTime=0x1d5ed7a, ftLastWriteTime.dwLowDateTime=0xd1496865, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18490)) returned 1 [0054.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.262] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\kq86mc1.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kQ86MC1.mkv.a" (normalized: "c:\\users\\fd1hvy\\desktop\\kq86mc1.mkv.a")) returned 1 [0054.263] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", lpFilePart=0x0) returned 0x21 [0054.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\krulz.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.263] GetFileType (hFile=0x2e4) returned 0x1 [0054.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.263] GetFileType (hFile=0x2e4) returned 0x1 [0054.263] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x82e3 [0054.267] ReadFile (in: hFile=0x2e4, lpBuffer=0x3377a98, nNumberOfBytesToRead=0x82e3, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3377a98*, lpNumberOfBytesRead=0x138e7fc*=0x82e3, lpOverlapped=0x0) returned 1 [0054.268] CloseHandle (hObject=0x2e4) returned 1 [0054.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.283] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", lpFilePart=0x0) returned 0x21 [0054.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\krulz.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.284] GetFileType (hFile=0x2e4) returned 0x1 [0054.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.284] GetFileType (hFile=0x2e4) returned 0x1 [0054.284] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ed734*, nNumberOfBytesToWrite=0x82f0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33ed734*, lpNumberOfBytesWritten=0x138e7f0*=0x82f0, lpOverlapped=0x0) returned 1 [0054.286] CloseHandle (hObject=0x2e4) returned 1 [0054.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc", lpFilePart=0x0) returned 0x21 [0054.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc.a", lpFilePart=0x0) returned 0x23 [0054.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\krulz.doc"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b00c00, ftCreationTime.dwHighDateTime=0x1d5e3c5, ftLastAccessTime.dwLowDateTime=0x38d75c10, ftLastAccessTime.dwHighDateTime=0x1d5e79c, ftLastWriteTime.dwLowDateTime=0xd14e2f7b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x82f0)) returned 1 [0054.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.287] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\krulz.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KRuLz.doc.a" (normalized: "c:\\users\\fd1hvy\\desktop\\krulz.doc.a")) returned 1 [0054.288] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", lpFilePart=0x0) returned 0x22 [0054.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\kukodo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.288] GetFileType (hFile=0x2e4) returned 0x1 [0054.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.288] GetFileType (hFile=0x2e4) returned 0x1 [0054.288] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xf506 [0054.288] ReadFile (in: hFile=0x2e4, lpBuffer=0x33f5dd8, nNumberOfBytesToRead=0xf506, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33f5dd8*, lpNumberOfBytesRead=0x138e7fc*=0xf506, lpOverlapped=0x0) returned 1 [0054.288] CloseHandle (hObject=0x2e4) returned 1 [0054.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", lpFilePart=0x0) returned 0x22 [0054.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\kukodo.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.384] GetFileType (hFile=0x2e4) returned 0x1 [0054.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.384] GetFileType (hFile=0x2e4) returned 0x1 [0054.384] WriteFile (in: hFile=0x2e4, lpBuffer=0x329afa8*, nNumberOfBytesToWrite=0xf510, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x329afa8*, lpNumberOfBytesWritten=0x138e7f0*=0xf510, lpOverlapped=0x0) returned 1 [0054.386] CloseHandle (hObject=0x2e4) returned 1 [0054.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4", lpFilePart=0x0) returned 0x22 [0054.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4.a", lpFilePart=0x0) returned 0x24 [0054.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\kukodo.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a31870, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x4d2c2360, ftLastAccessTime.dwHighDateTime=0x1d5e988, ftLastWriteTime.dwLowDateTime=0xd15c7d2c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf510)) returned 1 [0054.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.388] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\kukodo.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kukoDO.mp4.a" (normalized: "c:\\users\\fd1hvy\\desktop\\kukodo.mp4.a")) returned 1 [0054.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", lpFilePart=0x0) returned 0x21 [0054.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\mmsb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.389] GetFileType (hFile=0x2e4) returned 0x1 [0054.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.390] GetFileType (hFile=0x2e4) returned 0x1 [0054.390] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x5d8b [0054.390] ReadFile (in: hFile=0x2e4, lpBuffer=0x32aa878, nNumberOfBytesToRead=0x5d8b, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32aa878*, lpNumberOfBytesRead=0x138e7fc*=0x5d8b, lpOverlapped=0x0) returned 1 [0054.390] CloseHandle (hObject=0x2e4) returned 1 [0054.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", lpFilePart=0x0) returned 0x21 [0054.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.441] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\mmsb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.441] GetFileType (hFile=0x2e4) returned 0x1 [0054.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.442] GetFileType (hFile=0x2e4) returned 0x1 [0054.442] WriteFile (in: hFile=0x2e4, lpBuffer=0x3314b90*, nNumberOfBytesToWrite=0x5d90, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3314b90*, lpNumberOfBytesWritten=0x138e7f0*=0x5d90, lpOverlapped=0x0) returned 1 [0054.443] CloseHandle (hObject=0x2e4) returned 1 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx", lpFilePart=0x0) returned 0x21 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx.a", lpFilePart=0x0) returned 0x23 [0054.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\mmsb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de15c00, ftCreationTime.dwHighDateTime=0x1d5e7ad, ftLastAccessTime.dwLowDateTime=0xfeebc000, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0xd1660735, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5d90)) returned 1 [0054.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.444] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\mmsb.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mmSb.pptx.a" (normalized: "c:\\users\\fd1hvy\\desktop\\mmsb.pptx.a")) returned 1 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", lpFilePart=0x0) returned 0x2e [0054.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mtjxarpwijuz-pmnd0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.445] GetFileType (hFile=0x2e4) returned 0x1 [0054.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.445] GetFileType (hFile=0x2e4) returned 0x1 [0054.445] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xdef [0054.445] ReadFile (in: hFile=0x2e4, lpBuffer=0x331bb00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x331bb00*, lpNumberOfBytesRead=0x138e7fc*=0xdef, lpOverlapped=0x0) returned 1 [0054.445] CloseHandle (hObject=0x2e4) returned 1 [0054.459] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", lpFilePart=0x0) returned 0x2e [0054.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mtjxarpwijuz-pmnd0.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.461] GetFileType (hFile=0x2e4) returned 0x1 [0054.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.461] GetFileType (hFile=0x2e4) returned 0x1 [0054.461] WriteFile (in: hFile=0x2e4, lpBuffer=0x336e0a4*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x336e0a4*, lpNumberOfBytesWritten=0x138e7c4*=0xdf0, lpOverlapped=0x0) returned 1 [0054.461] CloseHandle (hObject=0x2e4) returned 1 [0054.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png", lpFilePart=0x0) returned 0x2e [0054.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png.a", lpFilePart=0x0) returned 0x30 [0054.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mtjxarpwijuz-pmnd0.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7414480, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x994253e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0xd1686a20, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xdf0)) returned 1 [0054.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.462] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\mtjxarpwijuz-pmnd0.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\MtjxaRpWiJUz-pMNd0.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\mtjxarpwijuz-pmnd0.png.a")) returned 1 [0054.463] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", lpFilePart=0x0) returned 0x23 [0054.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\or_8le.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.463] GetFileType (hFile=0x2e4) returned 0x1 [0054.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.463] GetFileType (hFile=0x2e4) returned 0x1 [0054.463] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xc983 [0054.463] ReadFile (in: hFile=0x2e4, lpBuffer=0x336f2e8, nNumberOfBytesToRead=0xc983, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x336f2e8*, lpNumberOfBytesRead=0x138e7fc*=0xc983, lpOverlapped=0x0) returned 1 [0054.463] CloseHandle (hObject=0x2e4) returned 1 [0054.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.505] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", lpFilePart=0x0) returned 0x23 [0054.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.505] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\or_8le.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.506] GetFileType (hFile=0x2e4) returned 0x1 [0054.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.506] GetFileType (hFile=0x2e4) returned 0x1 [0054.506] WriteFile (in: hFile=0x2e4, lpBuffer=0x33e1d98*, nNumberOfBytesToWrite=0xc990, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e1d98*, lpNumberOfBytesWritten=0x138e7f0*=0xc990, lpOverlapped=0x0) returned 1 [0054.508] CloseHandle (hObject=0x2e4) returned 1 [0054.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx", lpFilePart=0x0) returned 0x23 [0054.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx.a", lpFilePart=0x0) returned 0x25 [0054.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.509] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\or_8le.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e624df0, ftCreationTime.dwHighDateTime=0x1d5ee4c, ftLastAccessTime.dwLowDateTime=0xda19cee0, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xd16f8ecf, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc990)) returned 1 [0054.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.510] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\or_8le.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\OR_8lE.docx.a" (normalized: "c:\\users\\fd1hvy\\desktop\\or_8le.docx.a")) returned 1 [0054.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", lpFilePart=0x0) returned 0x2d [0054.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.510] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\phuiz_r3 psu2jrxn.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.510] GetFileType (hFile=0x2e4) returned 0x1 [0054.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.510] GetFileType (hFile=0x2e4) returned 0x1 [0054.510] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x140ab [0054.510] ReadFile (in: hFile=0x2e4, lpBuffer=0x33eeb18, nNumberOfBytesToRead=0x140ab, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33eeb18*, lpNumberOfBytesRead=0x138e7fc*=0x140ab, lpOverlapped=0x0) returned 1 [0054.511] CloseHandle (hObject=0x2e4) returned 1 [0054.529] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.529] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", lpFilePart=0x0) returned 0x2d [0054.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\phuiz_r3 psu2jrxn.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.579] GetFileType (hFile=0x2e4) returned 0x1 [0054.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.579] GetFileType (hFile=0x2e4) returned 0x1 [0054.579] WriteFile (in: hFile=0x2e4, lpBuffer=0x3477b28*, nNumberOfBytesToWrite=0x140b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3477b28*, lpNumberOfBytesWritten=0x138e7f0*=0x140b0, lpOverlapped=0x0) returned 1 [0054.581] CloseHandle (hObject=0x2e4) returned 1 [0054.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4", lpFilePart=0x0) returned 0x2d [0054.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4.a", lpFilePart=0x0) returned 0x2f [0054.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\phuiz_r3 psu2jrxn.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291179b0, ftCreationTime.dwHighDateTime=0x1d5e516, ftLastAccessTime.dwLowDateTime=0x4e53d750, ftLastAccessTime.dwHighDateTime=0x1d5e231, ftLastWriteTime.dwLowDateTime=0xd17b797f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x140b0)) returned 1 [0054.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\phuiz_r3 psu2jrxn.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\phuiz_R3 PSU2JRxN.mp4.a" (normalized: "c:\\users\\fd1hvy\\desktop\\phuiz_r3 psu2jrxn.mp4.a")) returned 1 [0054.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", lpFilePart=0x0) returned 0x22 [0054.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qtjkg5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.584] GetFileType (hFile=0x2e4) returned 0x1 [0054.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.584] GetFileType (hFile=0x2e4) returned 0x1 [0054.584] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x103c9 [0054.584] ReadFile (in: hFile=0x2e4, lpBuffer=0x348c004, nNumberOfBytesToRead=0x103c9, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x348c004*, lpNumberOfBytesRead=0x138e7fc*=0x103c9, lpOverlapped=0x0) returned 1 [0054.585] CloseHandle (hObject=0x2e4) returned 1 [0054.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", lpFilePart=0x0) returned 0x22 [0054.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qtjkg5.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.606] GetFileType (hFile=0x2e4) returned 0x1 [0054.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.607] GetFileType (hFile=0x2e4) returned 0x1 [0054.607] WriteFile (in: hFile=0x2e4, lpBuffer=0x32abd18*, nNumberOfBytesToWrite=0x103d0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32abd18*, lpNumberOfBytesWritten=0x138e7f0*=0x103d0, lpOverlapped=0x0) returned 1 [0054.611] CloseHandle (hObject=0x2e4) returned 1 [0054.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3", lpFilePart=0x0) returned 0x22 [0054.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3.a", lpFilePart=0x0) returned 0x24 [0054.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.613] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qtjkg5.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe73406d0, ftCreationTime.dwHighDateTime=0x1d5e5dc, ftLastAccessTime.dwLowDateTime=0x28a90b30, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xd1804106, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x103d0)) returned 1 [0054.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.613] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\qtjkg5.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\qTJkG5.mp3.a" (normalized: "c:\\users\\fd1hvy\\desktop\\qtjkg5.mp3.a")) returned 1 [0054.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", lpFilePart=0x0) returned 0x20 [0054.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\rsfq.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.613] GetFileType (hFile=0x2e4) returned 0x1 [0054.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.614] GetFileType (hFile=0x2e4) returned 0x1 [0054.614] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xc332 [0054.614] ReadFile (in: hFile=0x2e4, lpBuffer=0x32bc4a8, nNumberOfBytesToRead=0xc332, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32bc4a8*, lpNumberOfBytesRead=0x138e7fc*=0xc332, lpOverlapped=0x0) returned 1 [0054.614] CloseHandle (hObject=0x2e4) returned 1 [0054.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", lpFilePart=0x0) returned 0x20 [0054.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\rsfq.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.662] GetFileType (hFile=0x2e4) returned 0x1 [0054.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.662] GetFileType (hFile=0x2e4) returned 0x1 [0054.662] WriteFile (in: hFile=0x2e4, lpBuffer=0x332ddc4*, nNumberOfBytesToWrite=0xc340, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x332ddc4*, lpNumberOfBytesWritten=0x138e7f0*=0xc340, lpOverlapped=0x0) returned 1 [0054.663] CloseHandle (hObject=0x2e4) returned 1 [0054.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv", lpFilePart=0x0) returned 0x20 [0054.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv.a", lpFilePart=0x0) returned 0x22 [0054.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\rsfq.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58779ce0, ftCreationTime.dwHighDateTime=0x1d5e8bb, ftLastAccessTime.dwLowDateTime=0x44ee9040, ftLastAccessTime.dwHighDateTime=0x1d5e85f, ftLastWriteTime.dwLowDateTime=0xd18769b1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc340)) returned 1 [0054.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.665] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\rsfq.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rsFq.mkv.a" (normalized: "c:\\users\\fd1hvy\\desktop\\rsfq.mkv.a")) returned 1 [0054.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", lpFilePart=0x0) returned 0x2d [0054.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.666] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\rziwhrqchk3rcik02.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.666] GetFileType (hFile=0x2e4) returned 0x1 [0054.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.666] GetFileType (hFile=0x2e4) returned 0x1 [0054.666] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x83a9 [0054.666] ReadFile (in: hFile=0x2e4, lpBuffer=0x333a4e0, nNumberOfBytesToRead=0x83a9, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x333a4e0*, lpNumberOfBytesRead=0x138e7fc*=0x83a9, lpOverlapped=0x0) returned 1 [0054.666] CloseHandle (hObject=0x2e4) returned 1 [0054.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", lpFilePart=0x0) returned 0x2d [0054.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\rziwhrqchk3rcik02.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.693] GetFileType (hFile=0x2e4) returned 0x1 [0054.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.693] GetFileType (hFile=0x2e4) returned 0x1 [0054.693] WriteFile (in: hFile=0x2e4, lpBuffer=0x33b053c*, nNumberOfBytesToWrite=0x83b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b053c*, lpNumberOfBytesWritten=0x138e7f0*=0x83b0, lpOverlapped=0x0) returned 1 [0054.694] CloseHandle (hObject=0x2e4) returned 1 [0054.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf", lpFilePart=0x0) returned 0x2d [0054.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf.a", lpFilePart=0x0) returned 0x2f [0054.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\rziwhrqchk3rcik02.rtf"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771eb780, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0xa5bff850, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0xd18c2c40, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x83b0)) returned 1 [0054.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.696] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\rziwhrqchk3rcik02.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\RZiwHrqcHk3rcIk02.rtf.a" (normalized: "c:\\users\\fd1hvy\\desktop\\rziwhrqchk3rcik02.rtf.a")) returned 1 [0054.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", lpFilePart=0x0) returned 0x22 [0054.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\t o-yt.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.697] GetFileType (hFile=0x2e4) returned 0x1 [0054.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.697] GetFileType (hFile=0x2e4) returned 0x1 [0054.697] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xbc74 [0054.697] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b8d18, nNumberOfBytesToRead=0xbc74, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33b8d18*, lpNumberOfBytesRead=0x138e7fc*=0xbc74, lpOverlapped=0x0) returned 1 [0054.697] CloseHandle (hObject=0x2e4) returned 1 [0054.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", lpFilePart=0x0) returned 0x22 [0054.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\t o-yt.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.715] GetFileType (hFile=0x2e4) returned 0x1 [0054.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.715] GetFileType (hFile=0x2e4) returned 0x1 [0054.715] WriteFile (in: hFile=0x2e4, lpBuffer=0x3429094*, nNumberOfBytesToWrite=0xbc80, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3429094*, lpNumberOfBytesWritten=0x138e7f0*=0xbc80, lpOverlapped=0x0) returned 1 [0054.722] CloseHandle (hObject=0x2e4) returned 1 [0054.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv", lpFilePart=0x0) returned 0x22 [0054.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv.a", lpFilePart=0x0) returned 0x24 [0054.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\t o-yt.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12194e50, ftCreationTime.dwHighDateTime=0x1d5f03c, ftLastAccessTime.dwLowDateTime=0x7ef5c9b0, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0xd190f160, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xbc80)) returned 1 [0054.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.724] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\t o-yt.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\t o-Yt.mkv.a" (normalized: "c:\\users\\fd1hvy\\desktop\\t o-yt.mkv.a")) returned 1 [0054.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", lpFilePart=0x0) returned 0x22 [0054.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\th_rcs.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.724] GetFileType (hFile=0x2e4) returned 0x1 [0054.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.725] GetFileType (hFile=0x2e4) returned 0x1 [0054.725] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xd320 [0054.725] ReadFile (in: hFile=0x2e4, lpBuffer=0x34350dc, nNumberOfBytesToRead=0xd320, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x34350dc*, lpNumberOfBytesRead=0x138e7fc*=0xd320, lpOverlapped=0x0) returned 1 [0054.725] CloseHandle (hObject=0x2e4) returned 1 [0054.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.742] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", lpFilePart=0x0) returned 0x22 [0054.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\th_rcs.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.743] GetFileType (hFile=0x2e4) returned 0x1 [0054.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.743] GetFileType (hFile=0x2e4) returned 0x1 [0054.743] WriteFile (in: hFile=0x2e4, lpBuffer=0x34a9868*, nNumberOfBytesToWrite=0xd330, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x34a9868*, lpNumberOfBytesWritten=0x138e7f0*=0xd330, lpOverlapped=0x0) returned 1 [0054.745] CloseHandle (hObject=0x2e4) returned 1 [0054.746] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png", lpFilePart=0x0) returned 0x22 [0054.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png.a", lpFilePart=0x0) returned 0x24 [0054.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\th_rcs.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbc79d0, ftCreationTime.dwHighDateTime=0x1d5e27e, ftLastAccessTime.dwLowDateTime=0xc0178ac0, ftLastAccessTime.dwHighDateTime=0x1d5ec1e, ftLastWriteTime.dwLowDateTime=0xd19353f0, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd330)) returned 1 [0054.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.747] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png" (normalized: "c:\\users\\fd1hvy\\desktop\\th_rcs.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\th_rcS.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\th_rcs.png.a")) returned 1 [0054.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", lpFilePart=0x0) returned 0x22 [0054.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.747] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\uxegzz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.747] GetFileType (hFile=0x2e4) returned 0x1 [0054.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.747] GetFileType (hFile=0x2e4) returned 0x1 [0054.747] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x9546 [0054.750] ReadFile (in: hFile=0x2e4, lpBuffer=0x329b0e4, nNumberOfBytesToRead=0x9546, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x329b0e4*, lpNumberOfBytesRead=0x138e7fc*=0x9546, lpOverlapped=0x0) returned 1 [0054.750] CloseHandle (hObject=0x2e4) returned 1 [0054.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", lpFilePart=0x0) returned 0x22 [0054.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\uxegzz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.768] GetFileType (hFile=0x2e4) returned 0x1 [0054.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.768] GetFileType (hFile=0x2e4) returned 0x1 [0054.768] WriteFile (in: hFile=0x2e4, lpBuffer=0x3316abc*, nNumberOfBytesToWrite=0x9550, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3316abc*, lpNumberOfBytesWritten=0x138e7f0*=0x9550, lpOverlapped=0x0) returned 1 [0054.769] CloseHandle (hObject=0x2e4) returned 1 [0054.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg", lpFilePart=0x0) returned 0x22 [0054.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg.a", lpFilePart=0x0) returned 0x24 [0054.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\uxegzz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb986c810, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x79cbb4a0, ftLastAccessTime.dwHighDateTime=0x1d5edbe, ftLastWriteTime.dwLowDateTime=0xd1981888, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9550)) returned 1 [0054.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.771] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\uxegzz.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\uXegZz.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\uxegzz.jpg.a")) returned 1 [0054.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", lpFilePart=0x0) returned 0x22 [0054.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\y2rly3.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.772] GetFileType (hFile=0x2e4) returned 0x1 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.772] GetFileType (hFile=0x2e4) returned 0x1 [0054.772] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x2aa3 [0054.772] ReadFile (in: hFile=0x2e4, lpBuffer=0x3320404, nNumberOfBytesToRead=0x2aa3, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3320404*, lpNumberOfBytesRead=0x138e7fc*=0x2aa3, lpOverlapped=0x0) returned 1 [0054.772] CloseHandle (hObject=0x2e4) returned 1 [0054.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0054.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0054.787] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", lpFilePart=0x0) returned 0x22 [0054.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0054.787] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\y2rly3.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.787] GetFileType (hFile=0x2e4) returned 0x1 [0054.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0054.788] GetFileType (hFile=0x2e4) returned 0x1 [0054.788] WriteFile (in: hFile=0x2e4, lpBuffer=0x337a760*, nNumberOfBytesToWrite=0x2ab0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x337a760*, lpNumberOfBytesWritten=0x138e7f0*=0x2ab0, lpOverlapped=0x0) returned 1 [0054.788] CloseHandle (hObject=0x2e4) returned 1 [0054.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png", lpFilePart=0x0) returned 0x22 [0054.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png.a", lpFilePart=0x0) returned 0x24 [0054.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0054.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\y2rly3.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c6b140, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x84befc50, ftLastAccessTime.dwHighDateTime=0x1d5e1ca, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x2ab0)) returned 1 [0054.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0054.789] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png" (normalized: "c:\\users\\fd1hvy\\desktop\\y2rly3.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\y2rly3.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\y2rly3.png.a")) returned 1 [0054.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0054.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", lpFilePart=0x0) returned 0x1f [0054.790] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0054.790] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c1a80, ftCreationTime.dwHighDateTime=0x1d5e299, ftLastAccessTime.dwLowDateTime=0xde976f60, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0xde976f60, ftLastWriteTime.dwHighDateTime=0x1d5e656, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="3HrDhfqmZhB.png", cAlternateFileName="3HRDHF~1.PNG")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x165e7110, ftCreationTime.dwHighDateTime=0x1d5e683, ftLastAccessTime.dwLowDateTime=0xe5d766e0, ftLastAccessTime.dwHighDateTime=0x1d5e485, ftLastWriteTime.dwLowDateTime=0xe5d766e0, ftLastWriteTime.dwHighDateTime=0x1d5e485, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eJ8m_9DMOxSjz1msI n.gif", cAlternateFileName="7EJ8M_~1.GIF")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e53b470, ftCreationTime.dwHighDateTime=0x1d5e7cf, ftLastAccessTime.dwLowDateTime=0x154be990, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x154be990, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x1559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7M364Y3X_UXYU UP.png", cAlternateFileName="7M364Y~1.PNG")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be37b00, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cb11c10, ftLastAccessTime.dwHighDateTime=0x1d5e19c, ftLastWriteTime.dwLowDateTime=0x2cb11c10, ftLastWriteTime.dwHighDateTime=0x1d5e19c, nFileSizeHigh=0x0, nFileSizeLow=0x111b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPnucObt29svDP.avi", cAlternateFileName="APNUCO~1.AVI")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879528f0, ftCreationTime.dwHighDateTime=0x1d5e1d9, ftLastAccessTime.dwLowDateTime=0x721673d0, ftLastAccessTime.dwHighDateTime=0x1d5e35f, ftLastWriteTime.dwLowDateTime=0x721673d0, ftLastWriteTime.dwHighDateTime=0x1d5e35f, nFileSizeHigh=0x0, nFileSizeLow=0xfc87, dwReserved0=0x0, dwReserved1=0x0, cFileName="GedEdvNmNJKI5mm.flv", cAlternateFileName="GEDEDV~1.FLV")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365ea830, ftCreationTime.dwHighDateTime=0x1d5ef21, ftLastAccessTime.dwLowDateTime=0x638720c0, ftLastAccessTime.dwHighDateTime=0x1d5efef, ftLastWriteTime.dwLowDateTime=0x638720c0, ftLastWriteTime.dwHighDateTime=0x1d5efef, nFileSizeHigh=0x0, nFileSizeLow=0xdef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjtCuDnBSUUAtFETm.pps", cAlternateFileName="QJTCUD~1.PPS")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ada00, ftCreationTime.dwHighDateTime=0x1d5e437, ftLastAccessTime.dwLowDateTime=0x5352e4f0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x5352e4f0, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkYWC9I1XS-9Ff2-mwpj.mkv", cAlternateFileName="VKYWC9~1.MKV")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16cd2670, ftCreationTime.dwHighDateTime=0x1d5e749, ftLastAccessTime.dwLowDateTime=0xff5497e0, ftLastAccessTime.dwHighDateTime=0x1d5e733, ftLastWriteTime.dwLowDateTime=0xff5497e0, ftLastWriteTime.dwHighDateTime=0x1d5e733, nFileSizeHigh=0x0, nFileSizeLow=0x15344, dwReserved0=0x0, dwReserved1=0x0, cFileName="vskD.wav", cAlternateFileName="")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd969edc0, ftLastWriteTime.dwHighDateTime=0x1d5ec04, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg", cAlternateFileName="Y_0P8_~1.JPG")) returned 1 [0054.791] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0054.792] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0054.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0054.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0054.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0054.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", lpFilePart=0x0) returned 0x1f [0054.792] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc38 [0054.792] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xa4c5e330, ftLastAccessTime.dwHighDateTime=0x1d5ed26, ftLastWriteTime.dwLowDateTime=0xa4c5e330, ftLastWriteTime.dwHighDateTime=0x1d5ed26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.792] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c1a80, ftCreationTime.dwHighDateTime=0x1d5e299, ftLastAccessTime.dwLowDateTime=0xde976f60, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0xde976f60, ftLastWriteTime.dwHighDateTime=0x1d5e656, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="3HrDhfqmZhB.png", cAlternateFileName="3HRDHF~1.PNG")) returned 1 [0054.792] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x165e7110, ftCreationTime.dwHighDateTime=0x1d5e683, ftLastAccessTime.dwLowDateTime=0xe5d766e0, ftLastAccessTime.dwHighDateTime=0x1d5e485, ftLastWriteTime.dwLowDateTime=0xe5d766e0, ftLastWriteTime.dwHighDateTime=0x1d5e485, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eJ8m_9DMOxSjz1msI n.gif", cAlternateFileName="7EJ8M_~1.GIF")) returned 1 [0054.792] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e53b470, ftCreationTime.dwHighDateTime=0x1d5e7cf, ftLastAccessTime.dwLowDateTime=0x154be990, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0x154be990, ftLastWriteTime.dwHighDateTime=0x1d5ec6b, nFileSizeHigh=0x0, nFileSizeLow=0x1559a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7M364Y3X_UXYU UP.png", cAlternateFileName="7M364Y~1.PNG")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be37b00, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cb11c10, ftLastAccessTime.dwHighDateTime=0x1d5e19c, ftLastWriteTime.dwLowDateTime=0x2cb11c10, ftLastWriteTime.dwHighDateTime=0x1d5e19c, nFileSizeHigh=0x0, nFileSizeLow=0x111b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPnucObt29svDP.avi", cAlternateFileName="APNUCO~1.AVI")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879528f0, ftCreationTime.dwHighDateTime=0x1d5e1d9, ftLastAccessTime.dwLowDateTime=0x721673d0, ftLastAccessTime.dwHighDateTime=0x1d5e35f, ftLastWriteTime.dwLowDateTime=0x721673d0, ftLastWriteTime.dwHighDateTime=0x1d5e35f, nFileSizeHigh=0x0, nFileSizeLow=0xfc87, dwReserved0=0x0, dwReserved1=0x0, cFileName="GedEdvNmNJKI5mm.flv", cAlternateFileName="GEDEDV~1.FLV")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365ea830, ftCreationTime.dwHighDateTime=0x1d5ef21, ftLastAccessTime.dwLowDateTime=0x638720c0, ftLastAccessTime.dwHighDateTime=0x1d5efef, ftLastWriteTime.dwLowDateTime=0x638720c0, ftLastWriteTime.dwHighDateTime=0x1d5efef, nFileSizeHigh=0x0, nFileSizeLow=0xdef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjtCuDnBSUUAtFETm.pps", cAlternateFileName="QJTCUD~1.PPS")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ada00, ftCreationTime.dwHighDateTime=0x1d5e437, ftLastAccessTime.dwLowDateTime=0x5352e4f0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0x5352e4f0, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkYWC9I1XS-9Ff2-mwpj.mkv", cAlternateFileName="VKYWC9~1.MKV")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16cd2670, ftCreationTime.dwHighDateTime=0x1d5e749, ftLastAccessTime.dwLowDateTime=0xff5497e0, ftLastAccessTime.dwHighDateTime=0x1d5e733, ftLastWriteTime.dwLowDateTime=0xff5497e0, ftLastWriteTime.dwHighDateTime=0x1d5e733, nFileSizeHigh=0x0, nFileSizeLow=0x15344, dwReserved0=0x0, dwReserved1=0x0, cFileName="vskD.wav", cAlternateFileName="")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd969edc0, ftLastWriteTime.dwHighDateTime=0x1d5ec04, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg", cAlternateFileName="Y_0P8_~1.JPG")) returned 1 [0054.793] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd969edc0, ftLastWriteTime.dwHighDateTime=0x1d5ec04, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg", cAlternateFileName="Y_0P8_~1.JPG")) returned 0 [0054.794] FindClose (in: hFindFile=0x169dc38 | out: hFindFile=0x169dc38) returned 1 [0054.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0054.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0054.794] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", lpFilePart=0x0) returned 0x2f [0054.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0054.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\3hrdhfqmzhb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.794] GetFileType (hFile=0x2e4) returned 0x1 [0054.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0054.794] GetFileType (hFile=0x2e4) returned 0x1 [0054.794] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xc878 [0054.794] ReadFile (in: hFile=0x2e4, lpBuffer=0x337fce0, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x337fce0*, lpNumberOfBytesRead=0x138e788*=0xc878, lpOverlapped=0x0) returned 1 [0054.794] CloseHandle (hObject=0x2e4) returned 1 [0054.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", lpFilePart=0x0) returned 0x2f [0054.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0054.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\3hrdhfqmzhb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.844] GetFileType (hFile=0x2e4) returned 0x1 [0054.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0054.844] GetFileType (hFile=0x2e4) returned 0x1 [0054.844] WriteFile (in: hFile=0x2e4, lpBuffer=0x33f245c*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33f245c*, lpNumberOfBytesWritten=0x138e77c*=0xc880, lpOverlapped=0x0) returned 1 [0054.846] CloseHandle (hObject=0x2e4) returned 1 [0054.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png", lpFilePart=0x0) returned 0x2f [0054.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png.a", lpFilePart=0x0) returned 0x31 [0054.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0054.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\3hrdhfqmzhb.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c1a80, ftCreationTime.dwHighDateTime=0x1d5e299, ftLastAccessTime.dwLowDateTime=0xde976f60, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0xd1a4043f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc880)) returned 1 [0054.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0054.848] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\3hrdhfqmzhb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\3HrDhfqmZhB.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\3hrdhfqmzhb.png.a")) returned 1 [0054.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", lpFilePart=0x0) returned 0x34 [0054.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0054.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\7m364y3x_uxyu up.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.848] GetFileType (hFile=0x2e4) returned 0x1 [0054.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0054.848] GetFileType (hFile=0x2e4) returned 0x1 [0054.848] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x1559a [0054.849] ReadFile (in: hFile=0x2e4, lpBuffer=0x437dc50, nNumberOfBytesToRead=0x1559a, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x437dc50*, lpNumberOfBytesRead=0x138e788*=0x1559a, lpOverlapped=0x0) returned 1 [0054.851] CloseHandle (hObject=0x2e4) returned 1 [0054.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", lpFilePart=0x0) returned 0x34 [0054.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0054.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\7m364y3x_uxyu up.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.892] GetFileType (hFile=0x2e4) returned 0x1 [0054.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0054.892] GetFileType (hFile=0x2e4) returned 0x1 [0054.892] WriteFile (in: hFile=0x2e4, lpBuffer=0x43e88a8*, nNumberOfBytesToWrite=0x155a0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x43e88a8*, lpNumberOfBytesWritten=0x138e77c*=0x155a0, lpOverlapped=0x0) returned 1 [0054.907] CloseHandle (hObject=0x2e4) returned 1 [0054.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png", lpFilePart=0x0) returned 0x34 [0054.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png.a", lpFilePart=0x0) returned 0x36 [0054.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0054.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\7m364y3x_uxyu up.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e53b470, ftCreationTime.dwHighDateTime=0x1d5e7cf, ftLastAccessTime.dwLowDateTime=0x154be990, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0xd1affa3b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x155a0)) returned 1 [0054.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0054.920] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\7m364y3x_uxyu up.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\7M364Y3X_UXYU UP.png.a" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\7m364y3x_uxyu up.png.a")) returned 1 [0054.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", lpFilePart=0x0) returned 0x32 [0054.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0054.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\apnucobt29svdp.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.921] GetFileType (hFile=0x2e4) returned 0x1 [0054.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0054.921] GetFileType (hFile=0x2e4) returned 0x1 [0054.921] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x111b1 [0054.921] ReadFile (in: hFile=0x2e4, lpBuffer=0x344c3ec, nNumberOfBytesToRead=0x111b1, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x344c3ec*, lpNumberOfBytesRead=0x138e788*=0x111b1, lpOverlapped=0x0) returned 1 [0054.922] CloseHandle (hObject=0x2e4) returned 1 [0054.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0054.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0054.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0054.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", lpFilePart=0x0) returned 0x32 [0054.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0054.971] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\apnucobt29svdp.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.973] GetFileType (hFile=0x2e4) returned 0x1 [0054.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0054.973] GetFileType (hFile=0x2e4) returned 0x1 [0054.973] WriteFile (in: hFile=0x2e4, lpBuffer=0x32de3bc*, nNumberOfBytesToWrite=0x111c0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x32de3bc*, lpNumberOfBytesWritten=0x138e77c*=0x111c0, lpOverlapped=0x0) returned 1 [0054.974] CloseHandle (hObject=0x2e4) returned 1 [0054.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi", lpFilePart=0x0) returned 0x32 [0054.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi.a", lpFilePart=0x0) returned 0x34 [0054.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0054.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\apnucobt29svdp.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be37b00, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cb11c10, ftLastAccessTime.dwHighDateTime=0x1d5e19c, ftLastWriteTime.dwLowDateTime=0xd1b71949, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x111c0)) returned 1 [0054.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0054.977] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\apnucobt29svdp.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\aPnucObt29svDP.avi.a" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\apnucobt29svdp.avi.a")) returned 1 [0054.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", lpFilePart=0x0) returned 0x38 [0054.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0054.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\vkywc9i1xs-9ff2-mwpj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0054.978] GetFileType (hFile=0x2e4) returned 0x1 [0054.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0054.978] GetFileType (hFile=0x2e4) returned 0x1 [0054.978] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xe5a [0054.978] ReadFile (in: hFile=0x2e4, lpBuffer=0x32f08b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32f08b4*, lpNumberOfBytesRead=0x138e788*=0xe5a, lpOverlapped=0x0) returned 1 [0054.978] CloseHandle (hObject=0x2e4) returned 1 [0055.014] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.014] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", lpFilePart=0x0) returned 0x38 [0055.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0055.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\vkywc9i1xs-9ff2-mwpj.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.015] GetFileType (hFile=0x2e4) returned 0x1 [0055.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0055.015] GetFileType (hFile=0x2e4) returned 0x1 [0055.015] WriteFile (in: hFile=0x2e4, lpBuffer=0x3343200*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x138e750, lpOverlapped=0x0 | out: lpBuffer=0x3343200*, lpNumberOfBytesWritten=0x138e750*=0xe60, lpOverlapped=0x0) returned 1 [0055.016] CloseHandle (hObject=0x2e4) returned 1 [0055.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv", lpFilePart=0x0) returned 0x38 [0055.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv.a", lpFilePart=0x0) returned 0x3a [0055.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0055.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\vkywc9i1xs-9ff2-mwpj.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ada00, ftCreationTime.dwHighDateTime=0x1d5e437, ftLastAccessTime.dwLowDateTime=0x5352e4f0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0xd1be3de2, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0055.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0055.017] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\vkywc9i1xs-9ff2-mwpj.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\vkYWC9I1XS-9Ff2-mwpj.mkv.a" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\vkywc9i1xs-9ff2-mwpj.mkv.a")) returned 1 [0055.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", lpFilePart=0x0) returned 0x38 [0055.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0055.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\y_0p8_vkj-rbpjdes2jd.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.018] GetFileType (hFile=0x2e4) returned 0x1 [0055.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0055.018] GetFileType (hFile=0x2e4) returned 0x1 [0055.018] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xf5e [0055.018] ReadFile (in: hFile=0x2e4, lpBuffer=0x334544c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x334544c*, lpNumberOfBytesRead=0x138e788*=0xf5e, lpOverlapped=0x0) returned 1 [0055.018] CloseHandle (hObject=0x2e4) returned 1 [0055.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", lpFilePart=0x0) returned 0x38 [0055.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0055.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\y_0p8_vkj-rbpjdes2jd.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.033] GetFileType (hFile=0x2e4) returned 0x1 [0055.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0055.033] GetFileType (hFile=0x2e4) returned 0x1 [0055.033] WriteFile (in: hFile=0x2e4, lpBuffer=0x3398138*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x138e750, lpOverlapped=0x0 | out: lpBuffer=0x3398138*, lpNumberOfBytesWritten=0x138e750*=0xf60, lpOverlapped=0x0) returned 1 [0055.034] CloseHandle (hObject=0x2e4) returned 1 [0055.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg", lpFilePart=0x0) returned 0x38 [0055.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg.a", lpFilePart=0x0) returned 0x3a [0055.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0055.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\y_0p8_vkj-rbpjdes2jd.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf60)) returned 1 [0055.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0055.035] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\y_0p8_vkj-rbpjdes2jd.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\y_0P8_Vkj-rbPJDEs2JD.jpg.a" (normalized: "c:\\users\\fd1hvy\\desktop\\vwbl6uc\\y_0p8_vkj-rbpjdes2jd.jpg.a")) returned 1 [0055.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0055.036] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0055.036] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.036] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0055.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0055.037] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0055.037] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.037] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.038] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0055.038] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0055.038] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0055.038] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0055.038] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0055.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0055.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.049] GetFileType (hFile=0x2e4) returned 0x1 [0055.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.049] GetFileType (hFile=0x2e4) returned 0x1 [0055.049] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x1f5 [0055.049] ReadFile (in: hFile=0x2e4, lpBuffer=0x339a7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x339a7f0*, lpNumberOfBytesRead=0x138e7fc*=0x1f5, lpOverlapped=0x0) returned 1 [0055.050] CloseHandle (hObject=0x2e4) returned 1 [0055.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0055.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.133] GetFileType (hFile=0x2e4) returned 0x1 [0055.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.133] GetFileType (hFile=0x2e4) returned 0x1 [0055.133] WriteFile (in: hFile=0x2e4, lpBuffer=0x33e91b8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x33e91b8*, lpNumberOfBytesWritten=0x138e7c4*=0x200, lpOverlapped=0x0) returned 1 [0055.134] CloseHandle (hObject=0x2e4) returned 1 [0055.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0055.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.a", lpFilePart=0x0) returned 0x23 [0055.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xd1ceeef3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0055.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.140] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.a" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.a")) returned 1 [0055.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0055.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.140] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.141] GetFileType (hFile=0x2e4) returned 0x1 [0055.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.141] GetFileType (hFile=0x2e4) returned 0x1 [0055.141] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x3ae [0055.141] ReadFile (in: hFile=0x2e4, lpBuffer=0x33ea768, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33ea768*, lpNumberOfBytesRead=0x138e7fc*=0x3ae, lpOverlapped=0x0) returned 1 [0055.142] CloseHandle (hObject=0x2e4) returned 1 [0055.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0055.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.181] GetFileType (hFile=0x2e4) returned 0x1 [0055.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.181] GetFileType (hFile=0x2e4) returned 0x1 [0055.181] WriteFile (in: hFile=0x2e4, lpBuffer=0x34399a0*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x34399a0*, lpNumberOfBytesWritten=0x138e7c4*=0x3b0, lpOverlapped=0x0) returned 1 [0055.182] CloseHandle (hObject=0x2e4) returned 1 [0055.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0055.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.a", lpFilePart=0x0) returned 0x25 [0055.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xd1d61583, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0055.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.183] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.a" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.a")) returned 1 [0055.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0055.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.184] GetFileType (hFile=0x2e4) returned 0x1 [0055.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.184] GetFileType (hFile=0x2e4) returned 0x1 [0055.184] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x53a [0055.184] ReadFile (in: hFile=0x2e4, lpBuffer=0x343b0e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x343b0e8*, lpNumberOfBytesRead=0x138e7fc*=0x53a, lpOverlapped=0x0) returned 1 [0055.186] CloseHandle (hObject=0x2e4) returned 1 [0055.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0055.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.203] GetFileType (hFile=0x2e4) returned 0x1 [0055.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.203] GetFileType (hFile=0x2e4) returned 0x1 [0055.203] WriteFile (in: hFile=0x2e4, lpBuffer=0x348aaf4*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x348aaf4*, lpNumberOfBytesWritten=0x138e7c4*=0x540, lpOverlapped=0x0) returned 1 [0055.204] CloseHandle (hObject=0x2e4) returned 1 [0055.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0055.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.a", lpFilePart=0x0) returned 0x24 [0055.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.205] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xd1dad77c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0055.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.205] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.a" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.a")) returned 1 [0055.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0055.205] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.206] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.206] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.206] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0055.206] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.207] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0055.207] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0055.207] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd19a7b51, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.207] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd19a7b51, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.207] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d20ca50, ftCreationTime.dwHighDateTime=0x1d5ea9c, ftLastAccessTime.dwLowDateTime=0x7bcc680, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0xd0abc7ae, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe800, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oOWejWsgFpbJi.avi.a", cAlternateFileName="-OOWEJ~1.A")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a165d0, ftCreationTime.dwHighDateTime=0x1d5e7bd, ftLastAccessTime.dwLowDateTime=0x76ee69a0, ftLastAccessTime.dwHighDateTime=0x1d5e63c, ftLastWriteTime.dwLowDateTime=0xd0d45253, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x132e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Lu6NY1C.mp3.a", cAlternateFileName="3LU6NY~1.A")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b63d430, ftCreationTime.dwHighDateTime=0x1d5ee97, ftLastAccessTime.dwLowDateTime=0x2395340, ftLastAccessTime.dwHighDateTime=0x1d5e3fd, ftLastWriteTime.dwLowDateTime=0x2395340, ftLastWriteTime.dwHighDateTime=0x1d5e3fd, nFileSizeHigh=0x0, nFileSizeLow=0xbc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eS-i4hM.m4a", cAlternateFileName="")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa565a6d0, ftCreationTime.dwHighDateTime=0x1d5ed40, ftLastAccessTime.dwLowDateTime=0xfdf6750, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0xd0f0eee3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x84f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4phdci9dUrTtxEhd5.png.a", cAlternateFileName="4PHDCI~1.A")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abc90, ftCreationTime.dwHighDateTime=0x1d5eb9a, ftLastAccessTime.dwLowDateTime=0xf41c3f50, ftLastAccessTime.dwHighDateTime=0x1d5e84f, ftLastWriteTime.dwLowDateTime=0xd0ff3c93, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GZj_.ppt.a", cAlternateFileName="6GZJ_P~1.A")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7582f5a0, ftCreationTime.dwHighDateTime=0x1d5e2c1, ftLastAccessTime.dwLowDateTime=0x660f05f0, ftLastAccessTime.dwHighDateTime=0x1d5ead2, ftLastWriteTime.dwLowDateTime=0x660f05f0, ftLastWriteTime.dwHighDateTime=0x1d5ead2, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XkMBpJLi1Me6-.odp", cAlternateFileName="6XKMBP~1.ODP")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf11700, ftCreationTime.dwHighDateTime=0x1d5e44f, ftLastAccessTime.dwLowDateTime=0x415e7d20, ftLastAccessTime.dwHighDateTime=0x1d5e619, ftLastWriteTime.dwLowDateTime=0x415e7d20, ftLastWriteTime.dwHighDateTime=0x1d5e619, nFileSizeHigh=0x0, nFileSizeLow=0xb474, dwReserved0=0x0, dwReserved1=0x0, cFileName="6YEj.gif", cAlternateFileName="")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcbcfc0, ftCreationTime.dwHighDateTime=0x1d5e4d5, ftLastAccessTime.dwLowDateTime=0xa7dac2a0, ftLastAccessTime.dwHighDateTime=0x1d5e215, ftLastWriteTime.dwLowDateTime=0xd108c5eb, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18580, dwReserved0=0x0, dwReserved1=0x0, cFileName="99M_21.mp4.a", cAlternateFileName="99M_21~1.A")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761effa0, ftCreationTime.dwHighDateTime=0x1d5e513, ftLastAccessTime.dwLowDateTime=0x8df58690, ftLastAccessTime.dwHighDateTime=0x1d5e6f2, ftLastWriteTime.dwLowDateTime=0x8df58690, ftLastWriteTime.dwHighDateTime=0x1d5e6f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aHL2OKuyfw1Y.flv", cAlternateFileName="AHL2OK~1.FLV")) returned 1 [0055.208] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f73ea0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x405c8f30, ftLastAccessTime.dwHighDateTime=0x1d5ecf8, ftLastWriteTime.dwLowDateTime=0x405c8f30, ftLastWriteTime.dwHighDateTime=0x1d5ecf8, nFileSizeHigh=0x0, nFileSizeLow=0xaebd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDIUES.wav", cAlternateFileName="")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4768d0, ftCreationTime.dwHighDateTime=0x1d5f042, ftLastAccessTime.dwLowDateTime=0x16351c30, ftLastAccessTime.dwHighDateTime=0x1d5e317, ftLastWriteTime.dwLowDateTime=0x16351c30, ftLastWriteTime.dwHighDateTime=0x1d5e317, nFileSizeHigh=0x0, nFileSizeLow=0x29e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BwCWt.swf", cAlternateFileName="")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4dc4150, ftCreationTime.dwHighDateTime=0x1d5eec1, ftLastAccessTime.dwLowDateTime=0x2a8d4660, ftLastAccessTime.dwHighDateTime=0x1d5ed3c, ftLastWriteTime.dwLowDateTime=0xd10d8a52, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BzFCpK3sA5 wIqY9MGu.jpg.a", cAlternateFileName="BZFCPK~1.A")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bea64b0, ftCreationTime.dwHighDateTime=0x1d5ef3f, ftLastAccessTime.dwLowDateTime=0x65bfd110, ftLastAccessTime.dwHighDateTime=0x1d5e68b, ftLastWriteTime.dwLowDateTime=0xd1124e6a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKCfEqBglP.jpg.a", cAlternateFileName="DKCFEQ~1.A")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd1a910, ftCreationTime.dwHighDateTime=0x1d5eb95, ftLastAccessTime.dwLowDateTime=0xe5051050, ftLastAccessTime.dwHighDateTime=0x1d5ef89, ftLastWriteTime.dwLowDateTime=0xd119b925, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15680, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnES9puJGLTmbfl.jpg.a", cAlternateFileName="DNES9P~1.A")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73227680, ftCreationTime.dwHighDateTime=0x1d5ef9d, ftLastAccessTime.dwLowDateTime=0x12507ed0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0xd120e059, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x121b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_PYESz.pptx.a", cAlternateFileName="E_PYES~1.A")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcfd2b0, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x5da4f800, ftLastAccessTime.dwHighDateTime=0x1d5ed40, ftLastWriteTime.dwLowDateTime=0xd125a71a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4QGiSQ-xLpo.csv.a", cAlternateFileName="F4QGIS~1.A")) returned 1 [0055.209] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e8000, ftCreationTime.dwHighDateTime=0x1d5ea18, ftLastAccessTime.dwLowDateTime=0x85204ae0, ftLastAccessTime.dwHighDateTime=0x1d5efdb, ftLastWriteTime.dwLowDateTime=0xd12a6c28, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="g471KyerOmcuRL fE5 B.jpg.a", cAlternateFileName="G471KY~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac1770, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x74f84280, ftLastAccessTime.dwHighDateTime=0x1d5f04e, ftLastWriteTime.dwLowDateTime=0xd13b2fa4, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glbxRUnvXcoLYQx2cpe.ppt.a", cAlternateFileName="GLBXRU~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e92f060, ftCreationTime.dwHighDateTime=0x1d5eaa1, ftLastAccessTime.dwLowDateTime=0x757af4b0, ftLastAccessTime.dwHighDateTime=0x1d5e224, ftLastWriteTime.dwLowDateTime=0x757af4b0, ftLastWriteTime.dwHighDateTime=0x1d5e224, nFileSizeHigh=0x0, nFileSizeLow=0x1411f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IddVn8dHRg5G5Fl.m4a", cAlternateFileName="IDDVN8~1.M4A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f2c650, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0x6e2b5c10, ftLastAccessTime.dwHighDateTime=0x1d5eb64, ftLastWriteTime.dwLowDateTime=0xd144a5fd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x7650, dwReserved0=0x0, dwReserved1=0x0, cFileName="Isc XPXB1.avi.a", cAlternateFileName="ISCXPX~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3c44e0, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0x9d36e680, ftLastAccessTime.dwHighDateTime=0x1d5e2b0, ftLastWriteTime.dwLowDateTime=0x9d36e680, ftLastWriteTime.dwHighDateTime=0x1d5e2b0, nFileSizeHigh=0x0, nFileSizeLow=0x911e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1LCP7NhdkCDO6.swf", cAlternateFileName="K1LCP7~1.SWF")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c370f0, ftCreationTime.dwHighDateTime=0x1d5e659, ftLastAccessTime.dwLowDateTime=0x2a30f260, ftLastAccessTime.dwHighDateTime=0x1d5eac7, ftLastWriteTime.dwLowDateTime=0x2a30f260, ftLastWriteTime.dwHighDateTime=0x1d5eac7, nFileSizeHigh=0x0, nFileSizeLow=0x4c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkgIaojIPpj245YHEisL.m4a", cAlternateFileName="KKGIAO~1.M4A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3b23c0, ftCreationTime.dwHighDateTime=0x1d5e533, ftLastAccessTime.dwLowDateTime=0x1e865210, ftLastAccessTime.dwHighDateTime=0x1d5ed7a, ftLastWriteTime.dwLowDateTime=0xd1496865, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18490, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ86MC1.mkv.a", cAlternateFileName="KQ86MC~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b00c00, ftCreationTime.dwHighDateTime=0x1d5e3c5, ftLastAccessTime.dwLowDateTime=0x38d75c10, ftLastAccessTime.dwHighDateTime=0x1d5e79c, ftLastWriteTime.dwLowDateTime=0xd14e2f7b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x82f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRuLz.doc.a", cAlternateFileName="KRULZD~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a31870, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x4d2c2360, ftLastAccessTime.dwHighDateTime=0x1d5e988, ftLastWriteTime.dwLowDateTime=0xd15c7d2c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf510, dwReserved0=0x0, dwReserved1=0x0, cFileName="kukoDO.mp4.a", cAlternateFileName="KUKODO~1.A")) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de15c00, ftCreationTime.dwHighDateTime=0x1d5e7ad, ftLastAccessTime.dwLowDateTime=0xfeebc000, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0xd1660735, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmSb.pptx.a", cAlternateFileName="MMSBPP~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7414480, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x994253e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0xd1686a20, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MtjxaRpWiJUz-pMNd0.png.a", cAlternateFileName="MTJXAR~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e624df0, ftCreationTime.dwHighDateTime=0x1d5ee4c, ftLastAccessTime.dwLowDateTime=0xda19cee0, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xd16f8ecf, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="OR_8lE.docx.a", cAlternateFileName="OR_8LE~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291179b0, ftCreationTime.dwHighDateTime=0x1d5e516, ftLastAccessTime.dwLowDateTime=0x4e53d750, ftLastAccessTime.dwHighDateTime=0x1d5e231, ftLastWriteTime.dwLowDateTime=0xd17b797f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x140b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="phuiz_R3 PSU2JRxN.mp4.a", cAlternateFileName="PHUIZ_~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe73406d0, ftCreationTime.dwHighDateTime=0x1d5e5dc, ftLastAccessTime.dwLowDateTime=0x28a90b30, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xd1804106, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x103d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qTJkG5.mp3.a", cAlternateFileName="QTJKG5~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58779ce0, ftCreationTime.dwHighDateTime=0x1d5e8bb, ftLastAccessTime.dwLowDateTime=0x44ee9040, ftLastAccessTime.dwHighDateTime=0x1d5e85f, ftLastWriteTime.dwLowDateTime=0xd18769b1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc340, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsFq.mkv.a", cAlternateFileName="RSFQMK~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771eb780, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0xa5bff850, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0xd18c2c40, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x83b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RZiwHrqcHk3rcIk02.rtf.a", cAlternateFileName="RZIWHR~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12194e50, ftCreationTime.dwHighDateTime=0x1d5f03c, ftLastAccessTime.dwLowDateTime=0x7ef5c9b0, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0xd190f160, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xbc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="t o-Yt.mkv.a", cAlternateFileName="TO-YTM~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbc79d0, ftCreationTime.dwHighDateTime=0x1d5e27e, ftLastAccessTime.dwLowDateTime=0xc0178ac0, ftLastAccessTime.dwHighDateTime=0x1d5ec1e, ftLastWriteTime.dwLowDateTime=0xd19353f0, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd330, dwReserved0=0x0, dwReserved1=0x0, cFileName="th_rcS.png.a", cAlternateFileName="TH_RCS~1.A")) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd2ad00, ftCreationTime.dwHighDateTime=0x1d5ebb4, ftLastAccessTime.dwLowDateTime=0x21f0f3c0, ftLastAccessTime.dwHighDateTime=0x1d5e829, ftLastWriteTime.dwLowDateTime=0x21f0f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e829, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="U0nm5SQrqaR6r.gif", cAlternateFileName="U0NM5S~1.GIF")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb986c810, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x79cbb4a0, ftLastAccessTime.dwHighDateTime=0x1d5edbe, ftLastWriteTime.dwLowDateTime=0xd1981888, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9550, dwReserved0=0x0, dwReserved1=0x0, cFileName="uXegZz.jpg.a", cAlternateFileName="UXEGZZ~1.A")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4191a0, ftCreationTime.dwHighDateTime=0x1d5e9b4, ftLastAccessTime.dwLowDateTime=0x3f2a5d70, ftLastAccessTime.dwHighDateTime=0x1d5eb5b, ftLastWriteTime.dwLowDateTime=0x3f2a5d70, ftLastWriteTime.dwHighDateTime=0x1d5eb5b, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VbesvrI1.ots", cAlternateFileName="")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5be6e20, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xdb2f0e50, ftLastAccessTime.dwHighDateTime=0x1d5eafc, ftLastWriteTime.dwLowDateTime=0xdb2f0e50, ftLastWriteTime.dwHighDateTime=0x1d5eafc, nFileSizeHigh=0x0, nFileSizeLow=0x1353f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpQpDkI.wav", cAlternateFileName="")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vWbL6uc", cAlternateFileName="")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c6b140, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x84befc50, ftLastAccessTime.dwHighDateTime=0x1d5e1ca, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x2ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="y2rly3.png.a", cAlternateFileName="Y2RLY3~1.A")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.212] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0055.213] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd19a7b51, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.213] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd19a7b51, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.213] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d20ca50, ftCreationTime.dwHighDateTime=0x1d5ea9c, ftLastAccessTime.dwLowDateTime=0x7bcc680, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0xd0abc7ae, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe800, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oOWejWsgFpbJi.avi.a", cAlternateFileName="-OOWEJ~1.A")) returned 1 [0055.213] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a165d0, ftCreationTime.dwHighDateTime=0x1d5e7bd, ftLastAccessTime.dwLowDateTime=0x76ee69a0, ftLastAccessTime.dwHighDateTime=0x1d5e63c, ftLastWriteTime.dwLowDateTime=0xd0d45253, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x132e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Lu6NY1C.mp3.a", cAlternateFileName="3LU6NY~1.A")) returned 1 [0055.213] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b63d430, ftCreationTime.dwHighDateTime=0x1d5ee97, ftLastAccessTime.dwLowDateTime=0x2395340, ftLastAccessTime.dwHighDateTime=0x1d5e3fd, ftLastWriteTime.dwLowDateTime=0x2395340, ftLastWriteTime.dwHighDateTime=0x1d5e3fd, nFileSizeHigh=0x0, nFileSizeLow=0xbc71, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eS-i4hM.m4a", cAlternateFileName="")) returned 1 [0055.213] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa565a6d0, ftCreationTime.dwHighDateTime=0x1d5ed40, ftLastAccessTime.dwLowDateTime=0xfdf6750, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0xd0f0eee3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x84f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4phdci9dUrTtxEhd5.png.a", cAlternateFileName="4PHDCI~1.A")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87abc90, ftCreationTime.dwHighDateTime=0x1d5eb9a, ftLastAccessTime.dwLowDateTime=0xf41c3f50, ftLastAccessTime.dwHighDateTime=0x1d5e84f, ftLastWriteTime.dwLowDateTime=0xd0ff3c93, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GZj_.ppt.a", cAlternateFileName="6GZJ_P~1.A")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7582f5a0, ftCreationTime.dwHighDateTime=0x1d5e2c1, ftLastAccessTime.dwLowDateTime=0x660f05f0, ftLastAccessTime.dwHighDateTime=0x1d5ead2, ftLastWriteTime.dwLowDateTime=0x660f05f0, ftLastWriteTime.dwHighDateTime=0x1d5ead2, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XkMBpJLi1Me6-.odp", cAlternateFileName="6XKMBP~1.ODP")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf11700, ftCreationTime.dwHighDateTime=0x1d5e44f, ftLastAccessTime.dwLowDateTime=0x415e7d20, ftLastAccessTime.dwHighDateTime=0x1d5e619, ftLastWriteTime.dwLowDateTime=0x415e7d20, ftLastWriteTime.dwHighDateTime=0x1d5e619, nFileSizeHigh=0x0, nFileSizeLow=0xb474, dwReserved0=0x0, dwReserved1=0x0, cFileName="6YEj.gif", cAlternateFileName="")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcbcfc0, ftCreationTime.dwHighDateTime=0x1d5e4d5, ftLastAccessTime.dwLowDateTime=0xa7dac2a0, ftLastAccessTime.dwHighDateTime=0x1d5e215, ftLastWriteTime.dwLowDateTime=0xd108c5eb, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18580, dwReserved0=0x0, dwReserved1=0x0, cFileName="99M_21.mp4.a", cAlternateFileName="99M_21~1.A")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761effa0, ftCreationTime.dwHighDateTime=0x1d5e513, ftLastAccessTime.dwLowDateTime=0x8df58690, ftLastAccessTime.dwHighDateTime=0x1d5e6f2, ftLastWriteTime.dwLowDateTime=0x8df58690, ftLastWriteTime.dwHighDateTime=0x1d5e6f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aHL2OKuyfw1Y.flv", cAlternateFileName="AHL2OK~1.FLV")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f73ea0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x405c8f30, ftLastAccessTime.dwHighDateTime=0x1d5ecf8, ftLastWriteTime.dwLowDateTime=0x405c8f30, ftLastWriteTime.dwHighDateTime=0x1d5ecf8, nFileSizeHigh=0x0, nFileSizeLow=0xaebd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIDIUES.wav", cAlternateFileName="")) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4768d0, ftCreationTime.dwHighDateTime=0x1d5f042, ftLastAccessTime.dwLowDateTime=0x16351c30, ftLastAccessTime.dwHighDateTime=0x1d5e317, ftLastWriteTime.dwLowDateTime=0x16351c30, ftLastWriteTime.dwHighDateTime=0x1d5e317, nFileSizeHigh=0x0, nFileSizeLow=0x29e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BwCWt.swf", cAlternateFileName="")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4dc4150, ftCreationTime.dwHighDateTime=0x1d5eec1, ftLastAccessTime.dwLowDateTime=0x2a8d4660, ftLastAccessTime.dwHighDateTime=0x1d5ed3c, ftLastWriteTime.dwLowDateTime=0xd10d8a52, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BzFCpK3sA5 wIqY9MGu.jpg.a", cAlternateFileName="BZFCPK~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bea64b0, ftCreationTime.dwHighDateTime=0x1d5ef3f, ftLastAccessTime.dwLowDateTime=0x65bfd110, ftLastAccessTime.dwHighDateTime=0x1d5e68b, ftLastWriteTime.dwLowDateTime=0xd1124e6a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dKCfEqBglP.jpg.a", cAlternateFileName="DKCFEQ~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd1a910, ftCreationTime.dwHighDateTime=0x1d5eb95, ftLastAccessTime.dwLowDateTime=0xe5051050, ftLastAccessTime.dwHighDateTime=0x1d5ef89, ftLastWriteTime.dwLowDateTime=0xd119b925, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15680, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnES9puJGLTmbfl.jpg.a", cAlternateFileName="DNES9P~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73227680, ftCreationTime.dwHighDateTime=0x1d5ef9d, ftLastAccessTime.dwLowDateTime=0x12507ed0, ftLastAccessTime.dwHighDateTime=0x1d5e3a2, ftLastWriteTime.dwLowDateTime=0xd120e059, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x121b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E_PYESz.pptx.a", cAlternateFileName="E_PYES~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefcfd2b0, ftCreationTime.dwHighDateTime=0x1d5e177, ftLastAccessTime.dwLowDateTime=0x5da4f800, ftLastAccessTime.dwHighDateTime=0x1d5ed40, ftLastWriteTime.dwLowDateTime=0xd125a71a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4QGiSQ-xLpo.csv.a", cAlternateFileName="F4QGIS~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e8000, ftCreationTime.dwHighDateTime=0x1d5ea18, ftLastAccessTime.dwLowDateTime=0x85204ae0, ftLastAccessTime.dwHighDateTime=0x1d5efdb, ftLastWriteTime.dwLowDateTime=0xd12a6c28, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="g471KyerOmcuRL fE5 B.jpg.a", cAlternateFileName="G471KY~1.A")) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ac1770, ftCreationTime.dwHighDateTime=0x1d5e0ec, ftLastAccessTime.dwLowDateTime=0x74f84280, ftLastAccessTime.dwHighDateTime=0x1d5f04e, ftLastWriteTime.dwLowDateTime=0xd13b2fa4, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glbxRUnvXcoLYQx2cpe.ppt.a", cAlternateFileName="GLBXRU~1.A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e92f060, ftCreationTime.dwHighDateTime=0x1d5eaa1, ftLastAccessTime.dwLowDateTime=0x757af4b0, ftLastAccessTime.dwHighDateTime=0x1d5e224, ftLastWriteTime.dwLowDateTime=0x757af4b0, ftLastWriteTime.dwHighDateTime=0x1d5e224, nFileSizeHigh=0x0, nFileSizeLow=0x1411f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IddVn8dHRg5G5Fl.m4a", cAlternateFileName="IDDVN8~1.M4A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f2c650, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0x6e2b5c10, ftLastAccessTime.dwHighDateTime=0x1d5eb64, ftLastWriteTime.dwLowDateTime=0xd144a5fd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x7650, dwReserved0=0x0, dwReserved1=0x0, cFileName="Isc XPXB1.avi.a", cAlternateFileName="ISCXPX~1.A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3c44e0, ftCreationTime.dwHighDateTime=0x1d5ec93, ftLastAccessTime.dwLowDateTime=0x9d36e680, ftLastAccessTime.dwHighDateTime=0x1d5e2b0, ftLastWriteTime.dwLowDateTime=0x9d36e680, ftLastWriteTime.dwHighDateTime=0x1d5e2b0, nFileSizeHigh=0x0, nFileSizeLow=0x911e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k1LCP7NhdkCDO6.swf", cAlternateFileName="K1LCP7~1.SWF")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c370f0, ftCreationTime.dwHighDateTime=0x1d5e659, ftLastAccessTime.dwLowDateTime=0x2a30f260, ftLastAccessTime.dwHighDateTime=0x1d5eac7, ftLastWriteTime.dwLowDateTime=0x2a30f260, ftLastWriteTime.dwHighDateTime=0x1d5eac7, nFileSizeHigh=0x0, nFileSizeLow=0x4c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="KkgIaojIPpj245YHEisL.m4a", cAlternateFileName="KKGIAO~1.M4A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3b23c0, ftCreationTime.dwHighDateTime=0x1d5e533, ftLastAccessTime.dwLowDateTime=0x1e865210, ftLastAccessTime.dwHighDateTime=0x1d5ed7a, ftLastWriteTime.dwLowDateTime=0xd1496865, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18490, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQ86MC1.mkv.a", cAlternateFileName="KQ86MC~1.A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b00c00, ftCreationTime.dwHighDateTime=0x1d5e3c5, ftLastAccessTime.dwLowDateTime=0x38d75c10, ftLastAccessTime.dwHighDateTime=0x1d5e79c, ftLastWriteTime.dwLowDateTime=0xd14e2f7b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x82f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KRuLz.doc.a", cAlternateFileName="KRULZD~1.A")) returned 1 [0055.216] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a31870, ftCreationTime.dwHighDateTime=0x1d5e75f, ftLastAccessTime.dwLowDateTime=0x4d2c2360, ftLastAccessTime.dwHighDateTime=0x1d5e988, ftLastWriteTime.dwLowDateTime=0xd15c7d2c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf510, dwReserved0=0x0, dwReserved1=0x0, cFileName="kukoDO.mp4.a", cAlternateFileName="KUKODO~1.A")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2de15c00, ftCreationTime.dwHighDateTime=0x1d5e7ad, ftLastAccessTime.dwLowDateTime=0xfeebc000, ftLastAccessTime.dwHighDateTime=0x1d5e1b9, ftLastWriteTime.dwLowDateTime=0xd1660735, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mmSb.pptx.a", cAlternateFileName="MMSBPP~1.A")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7414480, ftCreationTime.dwHighDateTime=0x1d5e9e6, ftLastAccessTime.dwLowDateTime=0x994253e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0xd1686a20, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MtjxaRpWiJUz-pMNd0.png.a", cAlternateFileName="MTJXAR~1.A")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e624df0, ftCreationTime.dwHighDateTime=0x1d5ee4c, ftLastAccessTime.dwLowDateTime=0xda19cee0, ftLastAccessTime.dwHighDateTime=0x1d5e216, ftLastWriteTime.dwLowDateTime=0xd16f8ecf, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="OR_8lE.docx.a", cAlternateFileName="OR_8LE~1.A")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x291179b0, ftCreationTime.dwHighDateTime=0x1d5e516, ftLastAccessTime.dwLowDateTime=0x4e53d750, ftLastAccessTime.dwHighDateTime=0x1d5e231, ftLastWriteTime.dwLowDateTime=0xd17b797f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x140b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="phuiz_R3 PSU2JRxN.mp4.a", cAlternateFileName="PHUIZ_~1.A")) returned 1 [0055.372] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe73406d0, ftCreationTime.dwHighDateTime=0x1d5e5dc, ftLastAccessTime.dwLowDateTime=0x28a90b30, ftLastAccessTime.dwHighDateTime=0x1d5e2b6, ftLastWriteTime.dwLowDateTime=0xd1804106, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x103d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qTJkG5.mp3.a", cAlternateFileName="QTJKG5~1.A")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58779ce0, ftCreationTime.dwHighDateTime=0x1d5e8bb, ftLastAccessTime.dwLowDateTime=0x44ee9040, ftLastAccessTime.dwHighDateTime=0x1d5e85f, ftLastWriteTime.dwLowDateTime=0xd18769b1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc340, dwReserved0=0x0, dwReserved1=0x0, cFileName="rsFq.mkv.a", cAlternateFileName="RSFQMK~1.A")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x771eb780, ftCreationTime.dwHighDateTime=0x1d5eb15, ftLastAccessTime.dwLowDateTime=0xa5bff850, ftLastAccessTime.dwHighDateTime=0x1d5e4db, ftLastWriteTime.dwLowDateTime=0xd18c2c40, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x83b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RZiwHrqcHk3rcIk02.rtf.a", cAlternateFileName="RZIWHR~1.A")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12194e50, ftCreationTime.dwHighDateTime=0x1d5f03c, ftLastAccessTime.dwLowDateTime=0x7ef5c9b0, ftLastAccessTime.dwHighDateTime=0x1d5e153, ftLastWriteTime.dwLowDateTime=0xd190f160, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xbc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="t o-Yt.mkv.a", cAlternateFileName="TO-YTM~1.A")) returned 1 [0055.373] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfbc79d0, ftCreationTime.dwHighDateTime=0x1d5e27e, ftLastAccessTime.dwLowDateTime=0xc0178ac0, ftLastAccessTime.dwHighDateTime=0x1d5ec1e, ftLastWriteTime.dwLowDateTime=0xd19353f0, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd330, dwReserved0=0x0, dwReserved1=0x0, cFileName="th_rcS.png.a", cAlternateFileName="TH_RCS~1.A")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd2ad00, ftCreationTime.dwHighDateTime=0x1d5ebb4, ftLastAccessTime.dwLowDateTime=0x21f0f3c0, ftLastAccessTime.dwHighDateTime=0x1d5e829, ftLastWriteTime.dwLowDateTime=0x21f0f3c0, ftLastWriteTime.dwHighDateTime=0x1d5e829, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="U0nm5SQrqaR6r.gif", cAlternateFileName="U0NM5S~1.GIF")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb986c810, ftCreationTime.dwHighDateTime=0x1d5e304, ftLastAccessTime.dwLowDateTime=0x79cbb4a0, ftLastAccessTime.dwHighDateTime=0x1d5edbe, ftLastWriteTime.dwLowDateTime=0xd1981888, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9550, dwReserved0=0x0, dwReserved1=0x0, cFileName="uXegZz.jpg.a", cAlternateFileName="UXEGZZ~1.A")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4191a0, ftCreationTime.dwHighDateTime=0x1d5e9b4, ftLastAccessTime.dwLowDateTime=0x3f2a5d70, ftLastAccessTime.dwHighDateTime=0x1d5eb5b, ftLastWriteTime.dwLowDateTime=0x3f2a5d70, ftLastWriteTime.dwHighDateTime=0x1d5eb5b, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VbesvrI1.ots", cAlternateFileName="")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5be6e20, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xdb2f0e50, ftLastAccessTime.dwHighDateTime=0x1d5eafc, ftLastWriteTime.dwLowDateTime=0xdb2f0e50, ftLastWriteTime.dwHighDateTime=0x1d5eafc, nFileSizeHigh=0x0, nFileSizeLow=0x1353f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpQpDkI.wav", cAlternateFileName="")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vWbL6uc", cAlternateFileName="")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c6b140, ftCreationTime.dwHighDateTime=0x1d5e3a8, ftLastAccessTime.dwLowDateTime=0x84befc50, ftLastAccessTime.dwHighDateTime=0x1d5e1ca, ftLastWriteTime.dwLowDateTime=0xd19a7b51, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x2ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="y2rly3.png.a", cAlternateFileName="Y2RLY3~1.A")) returned 1 [0055.374] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 1 [0055.375] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fefa2a0, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0xf5263970, ftLastAccessTime.dwHighDateTime=0x1d5ed2a, ftLastWriteTime.dwLowDateTime=0xf5263970, ftLastWriteTime.dwHighDateTime=0x1d5ed2a, nFileSizeHigh=0x0, nFileSizeLow=0xe8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="zYAUQJ6rMEyiFb2.gif", cAlternateFileName="ZYAUQJ~1.GIF")) returned 0 [0055.375] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0055.375] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", lpFilePart=0x0) returned 0x1f [0055.375] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169ddb8 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c1a80, ftCreationTime.dwHighDateTime=0x1d5e299, ftLastAccessTime.dwLowDateTime=0xde976f60, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0xd1a4043f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc880, dwReserved0=0x0, dwReserved1=0x0, cFileName="3HrDhfqmZhB.png.a", cAlternateFileName="3HRDHF~1.A")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x165e7110, ftCreationTime.dwHighDateTime=0x1d5e683, ftLastAccessTime.dwLowDateTime=0xe5d766e0, ftLastAccessTime.dwHighDateTime=0x1d5e485, ftLastWriteTime.dwLowDateTime=0xe5d766e0, ftLastWriteTime.dwHighDateTime=0x1d5e485, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eJ8m_9DMOxSjz1msI n.gif", cAlternateFileName="7EJ8M_~1.GIF")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e53b470, ftCreationTime.dwHighDateTime=0x1d5e7cf, ftLastAccessTime.dwLowDateTime=0x154be990, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0xd1affa3b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x155a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7M364Y3X_UXYU UP.png.a", cAlternateFileName="7M364Y~1.A")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be37b00, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cb11c10, ftLastAccessTime.dwHighDateTime=0x1d5e19c, ftLastWriteTime.dwLowDateTime=0xd1b71949, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x111c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPnucObt29svDP.avi.a", cAlternateFileName="APNUCO~1.A")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879528f0, ftCreationTime.dwHighDateTime=0x1d5e1d9, ftLastAccessTime.dwLowDateTime=0x721673d0, ftLastAccessTime.dwHighDateTime=0x1d5e35f, ftLastWriteTime.dwLowDateTime=0x721673d0, ftLastWriteTime.dwHighDateTime=0x1d5e35f, nFileSizeHigh=0x0, nFileSizeLow=0xfc87, dwReserved0=0x0, dwReserved1=0x0, cFileName="GedEdvNmNJKI5mm.flv", cAlternateFileName="GEDEDV~1.FLV")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365ea830, ftCreationTime.dwHighDateTime=0x1d5ef21, ftLastAccessTime.dwLowDateTime=0x638720c0, ftLastAccessTime.dwHighDateTime=0x1d5efef, ftLastWriteTime.dwLowDateTime=0x638720c0, ftLastWriteTime.dwHighDateTime=0x1d5efef, nFileSizeHigh=0x0, nFileSizeLow=0xdef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjtCuDnBSUUAtFETm.pps", cAlternateFileName="QJTCUD~1.PPS")) returned 1 [0055.376] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ada00, ftCreationTime.dwHighDateTime=0x1d5e437, ftLastAccessTime.dwLowDateTime=0x5352e4f0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0xd1be3de2, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkYWC9I1XS-9Ff2-mwpj.mkv.a", cAlternateFileName="VKYWC9~1.A")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16cd2670, ftCreationTime.dwHighDateTime=0x1d5e749, ftLastAccessTime.dwLowDateTime=0xff5497e0, ftLastAccessTime.dwHighDateTime=0x1d5e733, ftLastWriteTime.dwLowDateTime=0xff5497e0, ftLastWriteTime.dwHighDateTime=0x1d5e733, nFileSizeHigh=0x0, nFileSizeLow=0x15344, dwReserved0=0x0, dwReserved1=0x0, cFileName="vskD.wav", cAlternateFileName="")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg.a", cAlternateFileName="Y_0P8_~1.A")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.377] FindClose (in: hFindFile=0x169ddb8 | out: hFindFile=0x169ddb8) returned 1 [0055.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0055.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0055.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0055.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc", lpFilePart=0x0) returned 0x1f [0055.377] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vWbL6uc\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc83d8a50, ftCreationTime.dwHighDateTime=0x1d5e87d, ftLastAccessTime.dwLowDateTime=0xd1c0a0a1, ftLastAccessTime.dwHighDateTime=0x1d6eb12, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35c1a80, ftCreationTime.dwHighDateTime=0x1d5e299, ftLastAccessTime.dwLowDateTime=0xde976f60, ftLastAccessTime.dwHighDateTime=0x1d5e656, ftLastWriteTime.dwLowDateTime=0xd1a4043f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc880, dwReserved0=0x0, dwReserved1=0x0, cFileName="3HrDhfqmZhB.png.a", cAlternateFileName="3HRDHF~1.A")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x165e7110, ftCreationTime.dwHighDateTime=0x1d5e683, ftLastAccessTime.dwLowDateTime=0xe5d766e0, ftLastAccessTime.dwHighDateTime=0x1d5e485, ftLastWriteTime.dwLowDateTime=0xe5d766e0, ftLastWriteTime.dwHighDateTime=0x1d5e485, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0x0, dwReserved1=0x0, cFileName="7eJ8m_9DMOxSjz1msI n.gif", cAlternateFileName="7EJ8M_~1.GIF")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e53b470, ftCreationTime.dwHighDateTime=0x1d5e7cf, ftLastAccessTime.dwLowDateTime=0x154be990, ftLastAccessTime.dwHighDateTime=0x1d5ec6b, ftLastWriteTime.dwLowDateTime=0xd1affa3b, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x155a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7M364Y3X_UXYU UP.png.a", cAlternateFileName="7M364Y~1.A")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1be37b00, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x2cb11c10, ftLastAccessTime.dwHighDateTime=0x1d5e19c, ftLastWriteTime.dwLowDateTime=0xd1b71949, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x111c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aPnucObt29svDP.avi.a", cAlternateFileName="APNUCO~1.A")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879528f0, ftCreationTime.dwHighDateTime=0x1d5e1d9, ftLastAccessTime.dwLowDateTime=0x721673d0, ftLastAccessTime.dwHighDateTime=0x1d5e35f, ftLastWriteTime.dwLowDateTime=0x721673d0, ftLastWriteTime.dwHighDateTime=0x1d5e35f, nFileSizeHigh=0x0, nFileSizeLow=0xfc87, dwReserved0=0x0, dwReserved1=0x0, cFileName="GedEdvNmNJKI5mm.flv", cAlternateFileName="GEDEDV~1.FLV")) returned 1 [0055.377] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365ea830, ftCreationTime.dwHighDateTime=0x1d5ef21, ftLastAccessTime.dwLowDateTime=0x638720c0, ftLastAccessTime.dwHighDateTime=0x1d5efef, ftLastWriteTime.dwLowDateTime=0x638720c0, ftLastWriteTime.dwHighDateTime=0x1d5efef, nFileSizeHigh=0x0, nFileSizeLow=0xdef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="QjtCuDnBSUUAtFETm.pps", cAlternateFileName="QJTCUD~1.PPS")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ada00, ftCreationTime.dwHighDateTime=0x1d5e437, ftLastAccessTime.dwLowDateTime=0x5352e4f0, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0xd1be3de2, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x0, dwReserved1=0x0, cFileName="vkYWC9I1XS-9Ff2-mwpj.mkv.a", cAlternateFileName="VKYWC9~1.A")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16cd2670, ftCreationTime.dwHighDateTime=0x1d5e749, ftLastAccessTime.dwLowDateTime=0xff5497e0, ftLastAccessTime.dwHighDateTime=0x1d5e733, ftLastWriteTime.dwLowDateTime=0xff5497e0, ftLastWriteTime.dwHighDateTime=0x1d5e733, nFileSizeHigh=0x0, nFileSizeLow=0x15344, dwReserved0=0x0, dwReserved1=0x0, cFileName="vskD.wav", cAlternateFileName="")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg.a", cAlternateFileName="Y_0P8_~1.A")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf83b680, ftCreationTime.dwHighDateTime=0x1d5ed06, ftLastAccessTime.dwLowDateTime=0xd969edc0, ftLastAccessTime.dwHighDateTime=0x1d5ec04, ftLastWriteTime.dwLowDateTime=0xd1c0a0a1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_0P8_Vkj-rbPJDEs2JD.jpg.a", cAlternateFileName="Y_0P8_~1.A")) returned 0 [0055.378] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0055.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0055.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0055.378] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4df8256, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4df8256, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4df8256, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4df8256, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d842c0, ftCreationTime.dwHighDateTime=0x1d5a355, ftLastAccessTime.dwLowDateTime=0x87f9d730, ftLastAccessTime.dwHighDateTime=0x1d5a2ac, ftLastWriteTime.dwLowDateTime=0x87f9d730, ftLastWriteTime.dwHighDateTime=0x1d5a2ac, nFileSizeHigh=0x0, nFileSizeLow=0x147a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="-kh7W.pptx", cAlternateFileName="-KH7W~1.PPT")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93c8a70, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0x6e7fde10, ftLastAccessTime.dwHighDateTime=0x1d5ee6c, ftLastWriteTime.dwLowDateTime=0x6e7fde10, ftLastWriteTime.dwHighDateTime=0x1d5ee6c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="0YLvRyMnzQZRK.pps", cAlternateFileName="0YLVRY~1.PPS")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b8ca190, ftCreationTime.dwHighDateTime=0x1d597b4, ftLastAccessTime.dwLowDateTime=0x55b4e1f0, ftLastAccessTime.dwHighDateTime=0x1d5eb01, ftLastWriteTime.dwLowDateTime=0x55b4e1f0, ftLastWriteTime.dwHighDateTime=0x1d5eb01, nFileSizeHigh=0x0, nFileSizeLow=0x8617, dwReserved0=0x0, dwReserved1=0x0, cFileName="2AlglI-kRXO07vf6mRl3.pptx", cAlternateFileName="2ALGLI~1.PPT")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3cf580, ftCreationTime.dwHighDateTime=0x1d5e5a2, ftLastAccessTime.dwLowDateTime=0xc9ab1a00, ftLastAccessTime.dwHighDateTime=0x1d5e73e, ftLastWriteTime.dwLowDateTime=0xc9ab1a00, ftLastWriteTime.dwHighDateTime=0x1d5e73e, nFileSizeHigh=0x0, nFileSizeLow=0x5722, dwReserved0=0x0, dwReserved1=0x0, cFileName="2eSzq9Y1XoyyJ.odt", cAlternateFileName="2ESZQ9~1.ODT")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eb71d0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0xe4ea5080, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0xe4ea5080, ftLastWriteTime.dwHighDateTime=0x1d5e250, nFileSizeHigh=0x0, nFileSizeLow=0x150d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YO1JI2QHo8.xlsx", cAlternateFileName="4YO1JI~1.XLS")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472a2d50, ftCreationTime.dwHighDateTime=0x1d5edce, ftLastAccessTime.dwLowDateTime=0x9d650a40, ftLastAccessTime.dwHighDateTime=0x1d5ed57, ftLastWriteTime.dwLowDateTime=0x9d650a40, ftLastWriteTime.dwHighDateTime=0x1d5ed57, nFileSizeHigh=0x0, nFileSizeLow=0x17ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="6A3x3HYZlUw-jocCtXyu.docx", cAlternateFileName="6A3X3H~1.DOC")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf67c30, ftCreationTime.dwHighDateTime=0x1d5ebf0, ftLastAccessTime.dwLowDateTime=0xf21f5960, ftLastAccessTime.dwHighDateTime=0x1d5cc6d, ftLastWriteTime.dwLowDateTime=0xf21f5960, ftLastWriteTime.dwHighDateTime=0x1d5cc6d, nFileSizeHigh=0x0, nFileSizeLow=0x10823, dwReserved0=0x0, dwReserved1=0x0, cFileName="6JUfaPYgT09Q.pptx", cAlternateFileName="6JUFAP~1.PPT")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566bd190, ftCreationTime.dwHighDateTime=0x1d58606, ftLastAccessTime.dwLowDateTime=0x273b05b0, ftLastAccessTime.dwHighDateTime=0x1d59d7d, ftLastWriteTime.dwLowDateTime=0x273b05b0, ftLastWriteTime.dwHighDateTime=0x1d59d7d, nFileSizeHigh=0x0, nFileSizeLow=0xd191, dwReserved0=0x0, dwReserved1=0x0, cFileName="7iH0V.docx", cAlternateFileName="7IH0V~1.DOC")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d94200, ftCreationTime.dwHighDateTime=0x1d5cadf, ftLastAccessTime.dwLowDateTime=0x63d38e60, ftLastAccessTime.dwHighDateTime=0x1d5e9e1, ftLastWriteTime.dwLowDateTime=0x63d38e60, ftLastWriteTime.dwHighDateTime=0x1d5e9e1, nFileSizeHigh=0x0, nFileSizeLow=0x6815, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pV8z.xlsx", cAlternateFileName="7PV8Z~1.XLS")) returned 1 [0055.378] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849781f0, ftCreationTime.dwHighDateTime=0x1d570de, ftLastAccessTime.dwLowDateTime=0xf0590260, ftLastAccessTime.dwHighDateTime=0x1d5d65f, ftLastWriteTime.dwLowDateTime=0xf0590260, ftLastWriteTime.dwHighDateTime=0x1d5d65f, nFileSizeHigh=0x0, nFileSizeLow=0xdf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Y5OPP98C74NYX.xlsx", cAlternateFileName="9Y5OPP~1.XLS")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc62c61e0, ftCreationTime.dwHighDateTime=0x1d5ee41, ftLastAccessTime.dwLowDateTime=0x30b7ba80, ftLastAccessTime.dwHighDateTime=0x1d565b9, ftLastWriteTime.dwLowDateTime=0x30b7ba80, ftLastWriteTime.dwHighDateTime=0x1d565b9, nFileSizeHigh=0x0, nFileSizeLow=0x9b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aAouGUNpl.pptx", cAlternateFileName="AAOUGU~1.PPT")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd731a640, ftCreationTime.dwHighDateTime=0x1d5ebde, ftLastAccessTime.dwLowDateTime=0xec0675f0, ftLastAccessTime.dwHighDateTime=0x1d5b164, ftLastWriteTime.dwLowDateTime=0xec0675f0, ftLastWriteTime.dwHighDateTime=0x1d5b164, nFileSizeHigh=0x0, nFileSizeLow=0x12996, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXjlS.docx", cAlternateFileName="BXJLS~1.DOC")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88329180, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0xb5fa6540, ftLastAccessTime.dwHighDateTime=0x1d5ea10, ftLastWriteTime.dwLowDateTime=0xb5fa6540, ftLastWriteTime.dwHighDateTime=0x1d5ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FHc0yWr1i.pdf", cAlternateFileName="FHC0YW~1.PDF")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713c8290, ftCreationTime.dwHighDateTime=0x1d5f018, ftLastAccessTime.dwLowDateTime=0xaa4b8a60, ftLastAccessTime.dwHighDateTime=0x1d5e9fe, ftLastWriteTime.dwLowDateTime=0xaa4b8a60, ftLastWriteTime.dwHighDateTime=0x1d5e9fe, nFileSizeHigh=0x0, nFileSizeLow=0x107b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HmNTn3.odt", cAlternateFileName="")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c4cf50, ftCreationTime.dwHighDateTime=0x1d5640f, ftLastAccessTime.dwLowDateTime=0x10b16d70, ftLastAccessTime.dwHighDateTime=0x1d5e887, ftLastWriteTime.dwLowDateTime=0x10b16d70, ftLastWriteTime.dwHighDateTime=0x1d5e887, nFileSizeHigh=0x0, nFileSizeLow=0xa299, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJoe7Hh.xlsx", cAlternateFileName="IJOE7H~1.XLS")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36917220, ftCreationTime.dwHighDateTime=0x1d5d08f, ftLastAccessTime.dwLowDateTime=0x46a0b4f0, ftLastAccessTime.dwHighDateTime=0x1d5d607, ftLastWriteTime.dwLowDateTime=0x46a0b4f0, ftLastWriteTime.dwHighDateTime=0x1d5d607, nFileSizeHigh=0x0, nFileSizeLow=0x148b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J iQz2X5eVcquOHDXjx.docx", cAlternateFileName="JIQZ2X~1.DOC")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa063f440, ftCreationTime.dwHighDateTime=0x1d5e023, ftLastAccessTime.dwLowDateTime=0x1b0dd120, ftLastAccessTime.dwHighDateTime=0x1d58453, ftLastWriteTime.dwLowDateTime=0x1b0dd120, ftLastWriteTime.dwHighDateTime=0x1d58453, nFileSizeHigh=0x0, nFileSizeLow=0x9e2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jBgd4y9d9T.pptx", cAlternateFileName="JBGD4Y~1.PPT")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e67a60, ftCreationTime.dwHighDateTime=0x1d5bdd1, ftLastAccessTime.dwLowDateTime=0xe4a77ac0, ftLastAccessTime.dwHighDateTime=0x1d5c72b, ftLastWriteTime.dwLowDateTime=0xe4a77ac0, ftLastWriteTime.dwHighDateTime=0x1d5c72b, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdhFe0o1UxY04c.docx", cAlternateFileName="KDHFE0~1.DOC")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac350ea0, ftCreationTime.dwHighDateTime=0x1d5ea71, ftLastAccessTime.dwLowDateTime=0xb6148010, ftLastAccessTime.dwHighDateTime=0x1d5ead8, ftLastWriteTime.dwLowDateTime=0xb6148010, ftLastWriteTime.dwHighDateTime=0x1d5ead8, nFileSizeHigh=0x0, nFileSizeLow=0x60e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O7LAjrgCCQ1T Qzj3.ppt", cAlternateFileName="O7LAJR~1.PPT")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4818f0, ftCreationTime.dwHighDateTime=0x1d5e8d8, ftLastAccessTime.dwLowDateTime=0x54476900, ftLastAccessTime.dwHighDateTime=0x1d5e971, ftLastWriteTime.dwLowDateTime=0x54476900, ftLastWriteTime.dwHighDateTime=0x1d5e971, nFileSizeHigh=0x0, nFileSizeLow=0xf760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORf11e65l-wzgxT.odt", cAlternateFileName="ORF11E~1.ODT")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rj5-SiksS", cAlternateFileName="RJ5-SI~1")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6095df40, ftCreationTime.dwHighDateTime=0x1d5681e, ftLastAccessTime.dwLowDateTime=0xe358d230, ftLastAccessTime.dwHighDateTime=0x1d5ba1b, ftLastWriteTime.dwLowDateTime=0xe358d230, ftLastWriteTime.dwHighDateTime=0x1d5ba1b, nFileSizeHigh=0x0, nFileSizeLow=0x13d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZT4Ovk.docx", cAlternateFileName="TZT4OV~1.DOC")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5841f870, ftCreationTime.dwHighDateTime=0x1d5efc2, ftLastAccessTime.dwLowDateTime=0x650076f0, ftLastAccessTime.dwHighDateTime=0x1d57d07, ftLastWriteTime.dwLowDateTime=0x650076f0, ftLastWriteTime.dwHighDateTime=0x1d57d07, nFileSizeHigh=0x0, nFileSizeLow=0x11d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8vJNHz 68_RzkaBSlFS.xlsx", cAlternateFileName="W8VJNH~1.XLS")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e484590, ftCreationTime.dwHighDateTime=0x1d5eda4, ftLastAccessTime.dwLowDateTime=0xbbb9ea60, ftLastAccessTime.dwHighDateTime=0x1d5e857, ftLastWriteTime.dwLowDateTime=0xbbb9ea60, ftLastWriteTime.dwHighDateTime=0x1d5e857, nFileSizeHigh=0x0, nFileSizeLow=0xac76, dwReserved0=0x0, dwReserved1=0x0, cFileName="_rTaR0wLgZy.rtf", cAlternateFileName="_RTAR0~1.RTF")) returned 1 [0055.379] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.379] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0055.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0055.380] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4df8256, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4df8256, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4df8256, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4df8256, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d842c0, ftCreationTime.dwHighDateTime=0x1d5a355, ftLastAccessTime.dwLowDateTime=0x87f9d730, ftLastAccessTime.dwHighDateTime=0x1d5a2ac, ftLastWriteTime.dwLowDateTime=0x87f9d730, ftLastWriteTime.dwHighDateTime=0x1d5a2ac, nFileSizeHigh=0x0, nFileSizeLow=0x147a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="-kh7W.pptx", cAlternateFileName="-KH7W~1.PPT")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93c8a70, ftCreationTime.dwHighDateTime=0x1d5e526, ftLastAccessTime.dwLowDateTime=0x6e7fde10, ftLastAccessTime.dwHighDateTime=0x1d5ee6c, ftLastWriteTime.dwLowDateTime=0x6e7fde10, ftLastWriteTime.dwHighDateTime=0x1d5ee6c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="0YLvRyMnzQZRK.pps", cAlternateFileName="0YLVRY~1.PPS")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b8ca190, ftCreationTime.dwHighDateTime=0x1d597b4, ftLastAccessTime.dwLowDateTime=0x55b4e1f0, ftLastAccessTime.dwHighDateTime=0x1d5eb01, ftLastWriteTime.dwLowDateTime=0x55b4e1f0, ftLastWriteTime.dwHighDateTime=0x1d5eb01, nFileSizeHigh=0x0, nFileSizeLow=0x8617, dwReserved0=0x0, dwReserved1=0x0, cFileName="2AlglI-kRXO07vf6mRl3.pptx", cAlternateFileName="2ALGLI~1.PPT")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3cf580, ftCreationTime.dwHighDateTime=0x1d5e5a2, ftLastAccessTime.dwLowDateTime=0xc9ab1a00, ftLastAccessTime.dwHighDateTime=0x1d5e73e, ftLastWriteTime.dwLowDateTime=0xc9ab1a00, ftLastWriteTime.dwHighDateTime=0x1d5e73e, nFileSizeHigh=0x0, nFileSizeLow=0x5722, dwReserved0=0x0, dwReserved1=0x0, cFileName="2eSzq9Y1XoyyJ.odt", cAlternateFileName="2ESZQ9~1.ODT")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eb71d0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0xe4ea5080, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0xe4ea5080, ftLastWriteTime.dwHighDateTime=0x1d5e250, nFileSizeHigh=0x0, nFileSizeLow=0x150d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="4YO1JI2QHo8.xlsx", cAlternateFileName="4YO1JI~1.XLS")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472a2d50, ftCreationTime.dwHighDateTime=0x1d5edce, ftLastAccessTime.dwLowDateTime=0x9d650a40, ftLastAccessTime.dwHighDateTime=0x1d5ed57, ftLastWriteTime.dwLowDateTime=0x9d650a40, ftLastWriteTime.dwHighDateTime=0x1d5ed57, nFileSizeHigh=0x0, nFileSizeLow=0x17ae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="6A3x3HYZlUw-jocCtXyu.docx", cAlternateFileName="6A3X3H~1.DOC")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf67c30, ftCreationTime.dwHighDateTime=0x1d5ebf0, ftLastAccessTime.dwLowDateTime=0xf21f5960, ftLastAccessTime.dwHighDateTime=0x1d5cc6d, ftLastWriteTime.dwLowDateTime=0xf21f5960, ftLastWriteTime.dwHighDateTime=0x1d5cc6d, nFileSizeHigh=0x0, nFileSizeLow=0x10823, dwReserved0=0x0, dwReserved1=0x0, cFileName="6JUfaPYgT09Q.pptx", cAlternateFileName="6JUFAP~1.PPT")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566bd190, ftCreationTime.dwHighDateTime=0x1d58606, ftLastAccessTime.dwLowDateTime=0x273b05b0, ftLastAccessTime.dwHighDateTime=0x1d59d7d, ftLastWriteTime.dwLowDateTime=0x273b05b0, ftLastWriteTime.dwHighDateTime=0x1d59d7d, nFileSizeHigh=0x0, nFileSizeLow=0xd191, dwReserved0=0x0, dwReserved1=0x0, cFileName="7iH0V.docx", cAlternateFileName="7IH0V~1.DOC")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d94200, ftCreationTime.dwHighDateTime=0x1d5cadf, ftLastAccessTime.dwLowDateTime=0x63d38e60, ftLastAccessTime.dwHighDateTime=0x1d5e9e1, ftLastWriteTime.dwLowDateTime=0x63d38e60, ftLastWriteTime.dwHighDateTime=0x1d5e9e1, nFileSizeHigh=0x0, nFileSizeLow=0x6815, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pV8z.xlsx", cAlternateFileName="7PV8Z~1.XLS")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849781f0, ftCreationTime.dwHighDateTime=0x1d570de, ftLastAccessTime.dwLowDateTime=0xf0590260, ftLastAccessTime.dwHighDateTime=0x1d5d65f, ftLastWriteTime.dwLowDateTime=0xf0590260, ftLastWriteTime.dwHighDateTime=0x1d5d65f, nFileSizeHigh=0x0, nFileSizeLow=0xdf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Y5OPP98C74NYX.xlsx", cAlternateFileName="9Y5OPP~1.XLS")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc62c61e0, ftCreationTime.dwHighDateTime=0x1d5ee41, ftLastAccessTime.dwLowDateTime=0x30b7ba80, ftLastAccessTime.dwHighDateTime=0x1d565b9, ftLastWriteTime.dwLowDateTime=0x30b7ba80, ftLastWriteTime.dwHighDateTime=0x1d565b9, nFileSizeHigh=0x0, nFileSizeLow=0x9b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aAouGUNpl.pptx", cAlternateFileName="AAOUGU~1.PPT")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd731a640, ftCreationTime.dwHighDateTime=0x1d5ebde, ftLastAccessTime.dwLowDateTime=0xec0675f0, ftLastAccessTime.dwHighDateTime=0x1d5b164, ftLastWriteTime.dwLowDateTime=0xec0675f0, ftLastWriteTime.dwHighDateTime=0x1d5b164, nFileSizeHigh=0x0, nFileSizeLow=0x12996, dwReserved0=0x0, dwReserved1=0x0, cFileName="BXjlS.docx", cAlternateFileName="BXJLS~1.DOC")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88329180, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0xb5fa6540, ftLastAccessTime.dwHighDateTime=0x1d5ea10, ftLastWriteTime.dwLowDateTime=0xb5fa6540, ftLastWriteTime.dwHighDateTime=0x1d5ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FHc0yWr1i.pdf", cAlternateFileName="FHC0YW~1.PDF")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713c8290, ftCreationTime.dwHighDateTime=0x1d5f018, ftLastAccessTime.dwLowDateTime=0xaa4b8a60, ftLastAccessTime.dwHighDateTime=0x1d5e9fe, ftLastWriteTime.dwLowDateTime=0xaa4b8a60, ftLastWriteTime.dwHighDateTime=0x1d5e9fe, nFileSizeHigh=0x0, nFileSizeLow=0x107b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HmNTn3.odt", cAlternateFileName="")) returned 1 [0055.380] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c4cf50, ftCreationTime.dwHighDateTime=0x1d5640f, ftLastAccessTime.dwLowDateTime=0x10b16d70, ftLastAccessTime.dwHighDateTime=0x1d5e887, ftLastWriteTime.dwLowDateTime=0x10b16d70, ftLastWriteTime.dwHighDateTime=0x1d5e887, nFileSizeHigh=0x0, nFileSizeLow=0xa299, dwReserved0=0x0, dwReserved1=0x0, cFileName="iJoe7Hh.xlsx", cAlternateFileName="IJOE7H~1.XLS")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36917220, ftCreationTime.dwHighDateTime=0x1d5d08f, ftLastAccessTime.dwLowDateTime=0x46a0b4f0, ftLastAccessTime.dwHighDateTime=0x1d5d607, ftLastWriteTime.dwLowDateTime=0x46a0b4f0, ftLastWriteTime.dwHighDateTime=0x1d5d607, nFileSizeHigh=0x0, nFileSizeLow=0x148b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J iQz2X5eVcquOHDXjx.docx", cAlternateFileName="JIQZ2X~1.DOC")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa063f440, ftCreationTime.dwHighDateTime=0x1d5e023, ftLastAccessTime.dwLowDateTime=0x1b0dd120, ftLastAccessTime.dwHighDateTime=0x1d58453, ftLastWriteTime.dwLowDateTime=0x1b0dd120, ftLastWriteTime.dwHighDateTime=0x1d58453, nFileSizeHigh=0x0, nFileSizeLow=0x9e2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jBgd4y9d9T.pptx", cAlternateFileName="JBGD4Y~1.PPT")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e67a60, ftCreationTime.dwHighDateTime=0x1d5bdd1, ftLastAccessTime.dwLowDateTime=0xe4a77ac0, ftLastAccessTime.dwHighDateTime=0x1d5c72b, ftLastWriteTime.dwLowDateTime=0xe4a77ac0, ftLastWriteTime.dwHighDateTime=0x1d5c72b, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kdhFe0o1UxY04c.docx", cAlternateFileName="KDHFE0~1.DOC")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac350ea0, ftCreationTime.dwHighDateTime=0x1d5ea71, ftLastAccessTime.dwLowDateTime=0xb6148010, ftLastAccessTime.dwHighDateTime=0x1d5ead8, ftLastWriteTime.dwLowDateTime=0xb6148010, ftLastWriteTime.dwHighDateTime=0x1d5ead8, nFileSizeHigh=0x0, nFileSizeLow=0x60e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="O7LAjrgCCQ1T Qzj3.ppt", cAlternateFileName="O7LAJR~1.PPT")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4818f0, ftCreationTime.dwHighDateTime=0x1d5e8d8, ftLastAccessTime.dwLowDateTime=0x54476900, ftLastAccessTime.dwHighDateTime=0x1d5e971, ftLastWriteTime.dwLowDateTime=0x54476900, ftLastWriteTime.dwHighDateTime=0x1d5e971, nFileSizeHigh=0x0, nFileSizeLow=0xf760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORf11e65l-wzgxT.odt", cAlternateFileName="ORF11E~1.ODT")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rj5-SiksS", cAlternateFileName="RJ5-SI~1")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6095df40, ftCreationTime.dwHighDateTime=0x1d5681e, ftLastAccessTime.dwLowDateTime=0xe358d230, ftLastAccessTime.dwHighDateTime=0x1d5ba1b, ftLastWriteTime.dwLowDateTime=0xe358d230, ftLastWriteTime.dwHighDateTime=0x1d5ba1b, nFileSizeHigh=0x0, nFileSizeLow=0x13d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZT4Ovk.docx", cAlternateFileName="TZT4OV~1.DOC")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5841f870, ftCreationTime.dwHighDateTime=0x1d5efc2, ftLastAccessTime.dwLowDateTime=0x650076f0, ftLastAccessTime.dwHighDateTime=0x1d57d07, ftLastWriteTime.dwLowDateTime=0x650076f0, ftLastWriteTime.dwHighDateTime=0x1d57d07, nFileSizeHigh=0x0, nFileSizeLow=0x11d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="w8vJNHz 68_RzkaBSlFS.xlsx", cAlternateFileName="W8VJNH~1.XLS")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e484590, ftCreationTime.dwHighDateTime=0x1d5eda4, ftLastAccessTime.dwLowDateTime=0xbbb9ea60, ftLastAccessTime.dwHighDateTime=0x1d5e857, ftLastWriteTime.dwLowDateTime=0xbbb9ea60, ftLastWriteTime.dwHighDateTime=0x1d5e857, nFileSizeHigh=0x0, nFileSizeLow=0xac76, dwReserved0=0x0, dwReserved1=0x0, cFileName="_rTaR0wLgZy.rtf", cAlternateFileName="_RTAR0~1.RTF")) returned 1 [0055.381] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e484590, ftCreationTime.dwHighDateTime=0x1d5eda4, ftLastAccessTime.dwLowDateTime=0xbbb9ea60, ftLastAccessTime.dwHighDateTime=0x1d5e857, ftLastWriteTime.dwLowDateTime=0xbbb9ea60, ftLastWriteTime.dwHighDateTime=0x1d5e857, nFileSizeHigh=0x0, nFileSizeLow=0xac76, dwReserved0=0x0, dwReserved1=0x0, cFileName="_rTaR0wLgZy.rtf", cAlternateFileName="_RTAR0~1.RTF")) returned 0 [0055.381] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0055.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0055.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0055.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", lpFilePart=0x0) returned 0x24 [0055.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-kh7w.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.382] GetFileType (hFile=0x2e4) returned 0x1 [0055.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.382] GetFileType (hFile=0x2e4) returned 0x1 [0055.382] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x147a5 [0055.382] ReadFile (in: hFile=0x2e4, lpBuffer=0x349c3d8, nNumberOfBytesToRead=0x147a5, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x349c3d8*, lpNumberOfBytesRead=0x138e7fc*=0x147a5, lpOverlapped=0x0) returned 1 [0055.382] CloseHandle (hObject=0x2e4) returned 1 [0055.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", lpFilePart=0x0) returned 0x24 [0055.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.440] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-kh7w.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.442] GetFileType (hFile=0x2e4) returned 0x1 [0055.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.442] GetFileType (hFile=0x2e4) returned 0x1 [0055.442] WriteFile (in: hFile=0x2e4, lpBuffer=0x33249b4*, nNumberOfBytesToWrite=0x147b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33249b4*, lpNumberOfBytesWritten=0x138e7f0*=0x147b0, lpOverlapped=0x0) returned 1 [0055.444] CloseHandle (hObject=0x2e4) returned 1 [0055.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx", lpFilePart=0x0) returned 0x24 [0055.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx.a", lpFilePart=0x0) returned 0x26 [0055.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-kh7w.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d842c0, ftCreationTime.dwHighDateTime=0x1d5a355, ftLastAccessTime.dwLowDateTime=0x87f9d730, ftLastAccessTime.dwHighDateTime=0x1d5a2ac, ftLastWriteTime.dwLowDateTime=0xd1fe9e29, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x147b0)) returned 1 [0055.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.446] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\-kh7w.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\-kh7W.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\-kh7w.pptx.a")) returned 1 [0055.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", lpFilePart=0x0) returned 0x33 [0055.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2algli-krxo07vf6mrl3.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.447] GetFileType (hFile=0x2e4) returned 0x1 [0055.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.447] GetFileType (hFile=0x2e4) returned 0x1 [0055.447] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x8617 [0055.447] ReadFile (in: hFile=0x2e4, lpBuffer=0x3339590, nNumberOfBytesToRead=0x8617, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3339590*, lpNumberOfBytesRead=0x138e7fc*=0x8617, lpOverlapped=0x0) returned 1 [0055.448] CloseHandle (hObject=0x2e4) returned 1 [0055.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", lpFilePart=0x0) returned 0x33 [0055.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2algli-krxo07vf6mrl3.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.465] GetFileType (hFile=0x2e4) returned 0x1 [0055.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.465] GetFileType (hFile=0x2e4) returned 0x1 [0055.465] WriteFile (in: hFile=0x2e4, lpBuffer=0x33b0378*, nNumberOfBytesToWrite=0x8620, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b0378*, lpNumberOfBytesWritten=0x138e7f0*=0x8620, lpOverlapped=0x0) returned 1 [0055.466] CloseHandle (hObject=0x2e4) returned 1 [0055.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx", lpFilePart=0x0) returned 0x33 [0055.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx.a", lpFilePart=0x0) returned 0x35 [0055.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2algli-krxo07vf6mrl3.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b8ca190, ftCreationTime.dwHighDateTime=0x1d597b4, ftLastAccessTime.dwLowDateTime=0x55b4e1f0, ftLastAccessTime.dwHighDateTime=0x1d5eb01, ftLastWriteTime.dwLowDateTime=0xd205c211, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8620)) returned 1 [0055.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.493] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2algli-krxo07vf6mrl3.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2AlglI-kRXO07vf6mRl3.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\2algli-krxo07vf6mrl3.pptx.a")) returned 1 [0055.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", lpFilePart=0x0) returned 0x2b [0055.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\2eszq9y1xoyyj.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.494] GetFileType (hFile=0x2e4) returned 0x1 [0055.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.494] GetFileType (hFile=0x2e4) returned 0x1 [0055.494] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x5722 [0055.495] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b8e18, nNumberOfBytesToRead=0x5722, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33b8e18*, lpNumberOfBytesRead=0x138e7fc*=0x5722, lpOverlapped=0x0) returned 1 [0055.495] CloseHandle (hObject=0x2e4) returned 1 [0055.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", lpFilePart=0x0) returned 0x2b [0055.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\2eszq9y1xoyyj.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.513] GetFileType (hFile=0x2e4) returned 0x1 [0055.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.513] GetFileType (hFile=0x2e4) returned 0x1 [0055.513] WriteFile (in: hFile=0x2e4, lpBuffer=0x3420ff4*, nNumberOfBytesToWrite=0x5730, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3420ff4*, lpNumberOfBytesWritten=0x138e7f0*=0x5730, lpOverlapped=0x0) returned 1 [0055.515] CloseHandle (hObject=0x2e4) returned 1 [0055.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt", lpFilePart=0x0) returned 0x2b [0055.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt.a", lpFilePart=0x0) returned 0x2d [0055.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\2eszq9y1xoyyj.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3cf580, ftCreationTime.dwHighDateTime=0x1d5e5a2, ftLastAccessTime.dwLowDateTime=0xc9ab1a00, ftLastAccessTime.dwHighDateTime=0x1d5e73e, ftLastWriteTime.dwLowDateTime=0xd20a8855, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5730)) returned 1 [0055.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.516] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt" (normalized: "c:\\users\\fd1hvy\\documents\\2eszq9y1xoyyj.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2eSzq9Y1XoyyJ.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\2eszq9y1xoyyj.odt.a")) returned 1 [0055.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", lpFilePart=0x0) returned 0x2a [0055.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4yo1ji2qho8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.517] GetFileType (hFile=0x2e4) returned 0x1 [0055.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.517] GetFileType (hFile=0x2e4) returned 0x1 [0055.517] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x150d9 [0055.518] ReadFile (in: hFile=0x2e4, lpBuffer=0x4449148, nNumberOfBytesToRead=0x150d9, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x4449148*, lpNumberOfBytesRead=0x138e7fc*=0x150d9, lpOverlapped=0x0) returned 1 [0055.519] CloseHandle (hObject=0x2e4) returned 1 [0055.562] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.563] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", lpFilePart=0x0) returned 0x2a [0055.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4yo1ji2qho8.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.564] GetFileType (hFile=0x2e4) returned 0x1 [0055.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.564] GetFileType (hFile=0x2e4) returned 0x1 [0055.564] WriteFile (in: hFile=0x2e4, lpBuffer=0x44b25e0*, nNumberOfBytesToWrite=0x150e0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x44b25e0*, lpNumberOfBytesWritten=0x138e7f0*=0x150e0, lpOverlapped=0x0) returned 1 [0055.566] CloseHandle (hObject=0x2e4) returned 1 [0055.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx", lpFilePart=0x0) returned 0x2a [0055.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx.a", lpFilePart=0x0) returned 0x2c [0055.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4yo1ji2qho8.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eb71d0, ftCreationTime.dwHighDateTime=0x1d5e742, ftLastAccessTime.dwLowDateTime=0xe4ea5080, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0xd211b099, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x150e0)) returned 1 [0055.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.569] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4yo1ji2qho8.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\4YO1JI2QHo8.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\4yo1ji2qho8.xlsx.a")) returned 1 [0055.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", lpFilePart=0x0) returned 0x33 [0055.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6a3x3hyzluw-jocctxyu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.570] GetFileType (hFile=0x2e4) returned 0x1 [0055.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.570] GetFileType (hFile=0x2e4) returned 0x1 [0055.570] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x17ae6 [0055.570] ReadFile (in: hFile=0x2e4, lpBuffer=0x44c76e0, nNumberOfBytesToRead=0x17ae6, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x44c76e0*, lpNumberOfBytesRead=0x138e7fc*=0x17ae6, lpOverlapped=0x0) returned 1 [0055.572] CloseHandle (hObject=0x2e4) returned 1 [0055.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", lpFilePart=0x0) returned 0x33 [0055.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6a3x3hyzluw-jocctxyu.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.700] GetFileType (hFile=0x2e4) returned 0x1 [0055.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.700] GetFileType (hFile=0x2e4) returned 0x1 [0055.700] WriteFile (in: hFile=0x2e4, lpBuffer=0x453ddc8*, nNumberOfBytesToWrite=0x17af0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x453ddc8*, lpNumberOfBytesWritten=0x138e7f0*=0x17af0, lpOverlapped=0x0) returned 1 [0055.703] CloseHandle (hObject=0x2e4) returned 1 [0055.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx", lpFilePart=0x0) returned 0x33 [0055.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx.a", lpFilePart=0x0) returned 0x35 [0055.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6a3x3hyzluw-jocctxyu.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472a2d50, ftCreationTime.dwHighDateTime=0x1d5edce, ftLastAccessTime.dwLowDateTime=0x9d650a40, ftLastAccessTime.dwHighDateTime=0x1d5ed57, ftLastWriteTime.dwLowDateTime=0xd2272673, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x17af0)) returned 1 [0055.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.706] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\6a3x3hyzluw-jocctxyu.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\6A3x3HYZlUw-jocCtXyu.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\6a3x3hyzluw-jocctxyu.docx.a")) returned 1 [0055.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", lpFilePart=0x0) returned 0x2b [0055.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.706] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\6jufapygt09q.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.706] GetFileType (hFile=0x2e4) returned 0x1 [0055.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.706] GetFileType (hFile=0x2e4) returned 0x1 [0055.706] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x10823 [0055.706] ReadFile (in: hFile=0x2e4, lpBuffer=0x32ac838, nNumberOfBytesToRead=0x10823, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32ac838*, lpNumberOfBytesRead=0x138e7fc*=0x10823, lpOverlapped=0x0) returned 1 [0055.707] CloseHandle (hObject=0x2e4) returned 1 [0055.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", lpFilePart=0x0) returned 0x2b [0055.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\6jufapygt09q.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.726] GetFileType (hFile=0x2e4) returned 0x1 [0055.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.726] GetFileType (hFile=0x2e4) returned 0x1 [0055.726] WriteFile (in: hFile=0x2e4, lpBuffer=0x332b024*, nNumberOfBytesToWrite=0x10830, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x332b024*, lpNumberOfBytesWritten=0x138e7f0*=0x10830, lpOverlapped=0x0) returned 1 [0055.728] CloseHandle (hObject=0x2e4) returned 1 [0055.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx", lpFilePart=0x0) returned 0x2b [0055.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx.a", lpFilePart=0x0) returned 0x2d [0055.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\6jufapygt09q.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf67c30, ftCreationTime.dwHighDateTime=0x1d5ebf0, ftLastAccessTime.dwLowDateTime=0xf21f5960, ftLastAccessTime.dwHighDateTime=0x1d5cc6d, ftLastWriteTime.dwLowDateTime=0xd22988de, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x10830)) returned 1 [0055.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\6jufapygt09q.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\6JUfaPYgT09Q.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\6jufapygt09q.pptx.a")) returned 1 [0055.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", lpFilePart=0x0) returned 0x24 [0055.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ih0v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.731] GetFileType (hFile=0x2e4) returned 0x1 [0055.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.731] GetFileType (hFile=0x2e4) returned 0x1 [0055.731] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xd191 [0055.731] ReadFile (in: hFile=0x2e4, lpBuffer=0x333bc6c, nNumberOfBytesToRead=0xd191, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x333bc6c*, lpNumberOfBytesRead=0x138e7fc*=0xd191, lpOverlapped=0x0) returned 1 [0055.731] CloseHandle (hObject=0x2e4) returned 1 [0055.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", lpFilePart=0x0) returned 0x24 [0055.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ih0v.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.830] GetFileType (hFile=0x2e4) returned 0x1 [0055.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.830] GetFileType (hFile=0x2e4) returned 0x1 [0055.830] WriteFile (in: hFile=0x2e4, lpBuffer=0x33aff4c*, nNumberOfBytesToWrite=0xd1a0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33aff4c*, lpNumberOfBytesWritten=0x138e7f0*=0xd1a0, lpOverlapped=0x0) returned 1 [0055.832] CloseHandle (hObject=0x2e4) returned 1 [0055.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx", lpFilePart=0x0) returned 0x24 [0055.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx.a", lpFilePart=0x0) returned 0x26 [0055.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ih0v.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x566bd190, ftCreationTime.dwHighDateTime=0x1d58606, ftLastAccessTime.dwLowDateTime=0x273b05b0, ftLastAccessTime.dwHighDateTime=0x1d59d7d, ftLastWriteTime.dwLowDateTime=0xd23a3831, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd1a0)) returned 1 [0055.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.834] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx" (normalized: "c:\\users\\fd1hvy\\documents\\7ih0v.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\7iH0V.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\7ih0v.docx.a")) returned 1 [0055.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", lpFilePart=0x0) returned 0x24 [0055.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7pv8z.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.835] GetFileType (hFile=0x2e4) returned 0x1 [0055.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.835] GetFileType (hFile=0x2e4) returned 0x1 [0055.835] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x6815 [0055.835] ReadFile (in: hFile=0x2e4, lpBuffer=0x33bd4c8, nNumberOfBytesToRead=0x6815, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33bd4c8*, lpNumberOfBytesRead=0x138e7fc*=0x6815, lpOverlapped=0x0) returned 1 [0055.835] CloseHandle (hObject=0x2e4) returned 1 [0055.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.851] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.852] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", lpFilePart=0x0) returned 0x24 [0055.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.852] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7pv8z.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.853] GetFileType (hFile=0x2e4) returned 0x1 [0055.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.853] GetFileType (hFile=0x2e4) returned 0x1 [0055.853] WriteFile (in: hFile=0x2e4, lpBuffer=0x342ab54*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x342ab54*, lpNumberOfBytesWritten=0x138e7f0*=0x6820, lpOverlapped=0x0) returned 1 [0055.854] CloseHandle (hObject=0x2e4) returned 1 [0055.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx", lpFilePart=0x0) returned 0x24 [0055.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx.a", lpFilePart=0x0) returned 0x26 [0055.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7pv8z.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d94200, ftCreationTime.dwHighDateTime=0x1d5cadf, ftLastAccessTime.dwLowDateTime=0x63d38e60, ftLastAccessTime.dwHighDateTime=0x1d5e9e1, ftLastWriteTime.dwLowDateTime=0xd23c9b2c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x6820)) returned 1 [0055.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.855] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7pv8z.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\7pV8z.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\7pv8z.xlsx.a")) returned 1 [0055.856] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", lpFilePart=0x0) returned 0x2d [0055.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.856] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9y5opp98c74nyx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.856] GetFileType (hFile=0x2e4) returned 0x1 [0055.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.856] GetFileType (hFile=0x2e4) returned 0x1 [0055.856] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xdf09 [0055.856] ReadFile (in: hFile=0x2e4, lpBuffer=0x3431770, nNumberOfBytesToRead=0xdf09, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3431770*, lpNumberOfBytesRead=0x138e7fc*=0xdf09, lpOverlapped=0x0) returned 1 [0055.856] CloseHandle (hObject=0x2e4) returned 1 [0055.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.892] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", lpFilePart=0x0) returned 0x2d [0055.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9y5opp98c74nyx.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.893] GetFileType (hFile=0x2e4) returned 0x1 [0055.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.893] GetFileType (hFile=0x2e4) returned 0x1 [0055.893] WriteFile (in: hFile=0x2e4, lpBuffer=0x328a0c0*, nNumberOfBytesToWrite=0xdf10, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x328a0c0*, lpNumberOfBytesWritten=0x138e7f0*=0xdf10, lpOverlapped=0x0) returned 1 [0055.895] CloseHandle (hObject=0x2e4) returned 1 [0055.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx", lpFilePart=0x0) returned 0x2d [0055.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx.a", lpFilePart=0x0) returned 0x2f [0055.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9y5opp98c74nyx.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x849781f0, ftCreationTime.dwHighDateTime=0x1d570de, ftLastAccessTime.dwLowDateTime=0xf0590260, ftLastAccessTime.dwHighDateTime=0x1d5d65f, ftLastWriteTime.dwLowDateTime=0xd243c21c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xdf10)) returned 1 [0055.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.897] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\9y5opp98c74nyx.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9Y5OPP98C74NYX.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\9y5opp98c74nyx.xlsx.a")) returned 1 [0055.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", lpFilePart=0x0) returned 0x28 [0055.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\aaougunpl.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.898] GetFileType (hFile=0x2e4) returned 0x1 [0055.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.898] GetFileType (hFile=0x2e4) returned 0x1 [0055.898] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x9b1e [0055.898] ReadFile (in: hFile=0x2e4, lpBuffer=0x329840c, nNumberOfBytesToRead=0x9b1e, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x329840c*, lpNumberOfBytesRead=0x138e7fc*=0x9b1e, lpOverlapped=0x0) returned 1 [0055.898] CloseHandle (hObject=0x2e4) returned 1 [0055.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0055.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0055.964] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0055.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0055.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", lpFilePart=0x0) returned 0x28 [0055.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0055.964] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\aaougunpl.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.965] GetFileType (hFile=0x2e4) returned 0x1 [0055.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0055.965] GetFileType (hFile=0x2e4) returned 0x1 [0055.965] WriteFile (in: hFile=0x2e4, lpBuffer=0x3315af4*, nNumberOfBytesToWrite=0x9b20, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3315af4*, lpNumberOfBytesWritten=0x138e7f0*=0x9b20, lpOverlapped=0x0) returned 1 [0055.966] CloseHandle (hObject=0x2e4) returned 1 [0055.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx", lpFilePart=0x0) returned 0x28 [0055.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx.a", lpFilePart=0x0) returned 0x2a [0055.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0055.985] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\aaougunpl.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc62c61e0, ftCreationTime.dwHighDateTime=0x1d5ee41, ftLastAccessTime.dwLowDateTime=0x30b7ba80, ftLastAccessTime.dwHighDateTime=0x1d565b9, ftLastWriteTime.dwLowDateTime=0xd2520d91, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9b20)) returned 1 [0055.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0055.985] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\aaougunpl.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aAouGUNpl.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\aaougunpl.pptx.a")) returned 1 [0055.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", lpFilePart=0x0) returned 0x24 [0055.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0055.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxjls.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0055.986] GetFileType (hFile=0x2e4) returned 0x1 [0055.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0055.986] GetFileType (hFile=0x2e4) returned 0x1 [0055.986] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x12996 [0055.986] ReadFile (in: hFile=0x2e4, lpBuffer=0x331fa18, nNumberOfBytesToRead=0x12996, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x331fa18*, lpNumberOfBytesRead=0x138e7fc*=0x12996, lpOverlapped=0x0) returned 1 [0055.987] CloseHandle (hObject=0x2e4) returned 1 [0056.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.004] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", lpFilePart=0x0) returned 0x24 [0056.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxjls.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.005] GetFileType (hFile=0x2e4) returned 0x1 [0056.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.005] GetFileType (hFile=0x2e4) returned 0x1 [0056.005] WriteFile (in: hFile=0x2e4, lpBuffer=0x33a44f8*, nNumberOfBytesToWrite=0x129a0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33a44f8*, lpNumberOfBytesWritten=0x138e7f0*=0x129a0, lpOverlapped=0x0) returned 1 [0056.007] CloseHandle (hObject=0x2e4) returned 1 [0056.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx", lpFilePart=0x0) returned 0x24 [0056.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx.a", lpFilePart=0x0) returned 0x26 [0056.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxjls.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd731a640, ftCreationTime.dwHighDateTime=0x1d5ebde, ftLastAccessTime.dwLowDateTime=0xec0675f0, ftLastAccessTime.dwHighDateTime=0x1d5b164, ftLastWriteTime.dwLowDateTime=0xd25475e8, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x129a0)) returned 1 [0056.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.009] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bxjls.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BXjlS.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\bxjls.docx.a")) returned 1 [0056.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", lpFilePart=0x0) returned 0x27 [0056.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fhc0ywr1i.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.010] GetFileType (hFile=0x2e4) returned 0x1 [0056.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.010] GetFileType (hFile=0x2e4) returned 0x1 [0056.010] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xd4d3 [0056.010] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b72b0, nNumberOfBytesToRead=0xd4d3, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33b72b0*, lpNumberOfBytesRead=0x138e7fc*=0xd4d3, lpOverlapped=0x0) returned 1 [0056.011] CloseHandle (hObject=0x2e4) returned 1 [0056.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", lpFilePart=0x0) returned 0x27 [0056.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fhc0ywr1i.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.027] GetFileType (hFile=0x2e4) returned 0x1 [0056.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.027] GetFileType (hFile=0x2e4) returned 0x1 [0056.027] WriteFile (in: hFile=0x2e4, lpBuffer=0x342bf50*, nNumberOfBytesToWrite=0xd4e0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x342bf50*, lpNumberOfBytesWritten=0x138e7f0*=0xd4e0, lpOverlapped=0x0) returned 1 [0056.029] CloseHandle (hObject=0x2e4) returned 1 [0056.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf", lpFilePart=0x0) returned 0x27 [0056.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf.a", lpFilePart=0x0) returned 0x29 [0056.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fhc0ywr1i.pdf"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88329180, ftCreationTime.dwHighDateTime=0x1d5e436, ftLastAccessTime.dwLowDateTime=0xb5fa6540, ftLastAccessTime.dwHighDateTime=0x1d5ea10, ftLastWriteTime.dwLowDateTime=0xd25b9902, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd4e0)) returned 1 [0056.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.059] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\fhc0ywr1i.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\FHc0yWr1i.pdf.a" (normalized: "c:\\users\\fd1hvy\\documents\\fhc0ywr1i.pdf.a")) returned 1 [0056.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", lpFilePart=0x0) returned 0x24 [0056.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt" (normalized: "c:\\users\\fd1hvy\\documents\\hmntn3.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.060] GetFileType (hFile=0x2e4) returned 0x1 [0056.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.060] GetFileType (hFile=0x2e4) returned 0x1 [0056.060] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x107b8 [0056.060] ReadFile (in: hFile=0x2e4, lpBuffer=0x3439820, nNumberOfBytesToRead=0x107b8, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3439820*, lpNumberOfBytesRead=0x138e7fc*=0x107b8, lpOverlapped=0x0) returned 1 [0056.061] CloseHandle (hObject=0x2e4) returned 1 [0056.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.140] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", lpFilePart=0x0) returned 0x24 [0056.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt" (normalized: "c:\\users\\fd1hvy\\documents\\hmntn3.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.142] GetFileType (hFile=0x2e4) returned 0x1 [0056.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.142] GetFileType (hFile=0x2e4) returned 0x1 [0056.142] WriteFile (in: hFile=0x2e4, lpBuffer=0x32c8b58*, nNumberOfBytesToWrite=0x107c0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32c8b58*, lpNumberOfBytesWritten=0x138e7f0*=0x107c0, lpOverlapped=0x0) returned 1 [0056.144] CloseHandle (hObject=0x2e4) returned 1 [0056.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt", lpFilePart=0x0) returned 0x24 [0056.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt.a", lpFilePart=0x0) returned 0x26 [0056.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt" (normalized: "c:\\users\\fd1hvy\\documents\\hmntn3.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713c8290, ftCreationTime.dwHighDateTime=0x1d5f018, ftLastAccessTime.dwLowDateTime=0xaa4b8a60, ftLastAccessTime.dwHighDateTime=0x1d5e9fe, ftLastWriteTime.dwLowDateTime=0xd269e500, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x107c0)) returned 1 [0056.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt" (normalized: "c:\\users\\fd1hvy\\documents\\hmntn3.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\HmNTn3.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\hmntn3.odt.a")) returned 1 [0056.148] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", lpFilePart=0x0) returned 0x26 [0056.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.148] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ijoe7hh.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.148] GetFileType (hFile=0x2e4) returned 0x1 [0056.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.148] GetFileType (hFile=0x2e4) returned 0x1 [0056.148] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xa299 [0056.148] ReadFile (in: hFile=0x2e4, lpBuffer=0x32d96fc, nNumberOfBytesToRead=0xa299, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32d96fc*, lpNumberOfBytesRead=0x138e7fc*=0xa299, lpOverlapped=0x0) returned 1 [0056.149] CloseHandle (hObject=0x2e4) returned 1 [0056.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", lpFilePart=0x0) returned 0x26 [0056.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ijoe7hh.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.166] GetFileType (hFile=0x2e4) returned 0x1 [0056.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.166] GetFileType (hFile=0x2e4) returned 0x1 [0056.166] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359364*, nNumberOfBytesToWrite=0xa2a0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3359364*, lpNumberOfBytesWritten=0x138e7f0*=0xa2a0, lpOverlapped=0x0) returned 1 [0056.167] CloseHandle (hObject=0x2e4) returned 1 [0056.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx", lpFilePart=0x0) returned 0x26 [0056.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx.a", lpFilePart=0x0) returned 0x28 [0056.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ijoe7hh.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c4cf50, ftCreationTime.dwHighDateTime=0x1d5640f, ftLastAccessTime.dwLowDateTime=0x10b16d70, ftLastAccessTime.dwHighDateTime=0x1d5e887, ftLastWriteTime.dwLowDateTime=0xd26c4a2f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa2a0)) returned 1 [0056.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.169] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ijoe7hh.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iJoe7Hh.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\ijoe7hh.xlsx.a")) returned 1 [0056.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", lpFilePart=0x0) returned 0x32 [0056.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j iqz2x5evcquohdxjx.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.169] GetFileType (hFile=0x2e4) returned 0x1 [0056.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.186] GetFileType (hFile=0x2e4) returned 0x1 [0056.186] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x148b2 [0056.186] ReadFile (in: hFile=0x2e4, lpBuffer=0x3363a2c, nNumberOfBytesToRead=0x148b2, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3363a2c*, lpNumberOfBytesRead=0x138e7fc*=0x148b2, lpOverlapped=0x0) returned 1 [0056.188] CloseHandle (hObject=0x2e4) returned 1 [0056.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", lpFilePart=0x0) returned 0x32 [0056.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j iqz2x5evcquohdxjx.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.382] GetFileType (hFile=0x2e4) returned 0x1 [0056.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.382] GetFileType (hFile=0x2e4) returned 0x1 [0056.382] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ee26c*, nNumberOfBytesToWrite=0x148c0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33ee26c*, lpNumberOfBytesWritten=0x138e7f0*=0x148c0, lpOverlapped=0x0) returned 1 [0056.384] CloseHandle (hObject=0x2e4) returned 1 [0056.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx", lpFilePart=0x0) returned 0x32 [0056.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx.a", lpFilePart=0x0) returned 0x34 [0056.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j iqz2x5evcquohdxjx.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36917220, ftCreationTime.dwHighDateTime=0x1d5d08f, ftLastAccessTime.dwLowDateTime=0x46a0b4f0, ftLastAccessTime.dwHighDateTime=0x1d5d607, ftLastWriteTime.dwLowDateTime=0xd28da7b6, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x148c0)) returned 1 [0056.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.387] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx" (normalized: "c:\\users\\fd1hvy\\documents\\j iqz2x5evcquohdxjx.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\J iQz2X5eVcquOHDXjx.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\j iqz2x5evcquohdxjx.docx.a")) returned 1 [0056.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", lpFilePart=0x0) returned 0x29 [0056.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jbgd4y9d9t.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.388] GetFileType (hFile=0x2e4) returned 0x1 [0056.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.388] GetFileType (hFile=0x2e4) returned 0x1 [0056.388] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x9e2b [0056.388] ReadFile (in: hFile=0x2e4, lpBuffer=0x3402fa4, nNumberOfBytesToRead=0x9e2b, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3402fa4*, lpNumberOfBytesRead=0x138e7fc*=0x9e2b, lpOverlapped=0x0) returned 1 [0056.389] CloseHandle (hObject=0x2e4) returned 1 [0056.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", lpFilePart=0x0) returned 0x29 [0056.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jbgd4y9d9t.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.411] GetFileType (hFile=0x2e4) returned 0x1 [0056.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.411] GetFileType (hFile=0x2e4) returned 0x1 [0056.411] WriteFile (in: hFile=0x2e4, lpBuffer=0x3481480*, nNumberOfBytesToWrite=0x9e30, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3481480*, lpNumberOfBytesWritten=0x138e7f0*=0x9e30, lpOverlapped=0x0) returned 1 [0056.413] CloseHandle (hObject=0x2e4) returned 1 [0056.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx", lpFilePart=0x0) returned 0x29 [0056.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx.a", lpFilePart=0x0) returned 0x2b [0056.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jbgd4y9d9t.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa063f440, ftCreationTime.dwHighDateTime=0x1d5e023, ftLastAccessTime.dwLowDateTime=0x1b0dd120, ftLastAccessTime.dwHighDateTime=0x1d58453, ftLastWriteTime.dwLowDateTime=0xd2926f97, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9e30)) returned 1 [0056.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.415] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\jbgd4y9d9t.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jBgd4y9d9T.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\jbgd4y9d9t.pptx.a")) returned 1 [0056.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", lpFilePart=0x0) returned 0x2d [0056.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kdhfe0o1uxy04c.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.415] GetFileType (hFile=0x2e4) returned 0x1 [0056.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.415] GetFileType (hFile=0x2e4) returned 0x1 [0056.415] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x4ce8 [0056.416] ReadFile (in: hFile=0x2e4, lpBuffer=0x348b6d4, nNumberOfBytesToRead=0x4ce8, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x348b6d4*, lpNumberOfBytesRead=0x138e7fc*=0x4ce8, lpOverlapped=0x0) returned 1 [0056.416] CloseHandle (hObject=0x2e4) returned 1 [0056.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", lpFilePart=0x0) returned 0x2d [0056.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kdhfe0o1uxy04c.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.493] GetFileType (hFile=0x2e4) returned 0x1 [0056.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.493] GetFileType (hFile=0x2e4) returned 0x1 [0056.493] WriteFile (in: hFile=0x2e4, lpBuffer=0x32f58d0*, nNumberOfBytesToWrite=0x4cf0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32f58d0*, lpNumberOfBytesWritten=0x138e7f0*=0x4cf0, lpOverlapped=0x0) returned 1 [0056.495] CloseHandle (hObject=0x2e4) returned 1 [0056.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx", lpFilePart=0x0) returned 0x2d [0056.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx.a", lpFilePart=0x0) returned 0x2f [0056.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kdhfe0o1uxy04c.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e67a60, ftCreationTime.dwHighDateTime=0x1d5bdd1, ftLastAccessTime.dwLowDateTime=0xe4a77ac0, ftLastAccessTime.dwHighDateTime=0x1d5c72b, ftLastWriteTime.dwLowDateTime=0xd29e5e5f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x4cf0)) returned 1 [0056.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.496] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\kdhfe0o1uxy04c.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\kdhFe0o1UxY04c.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\kdhfe0o1uxy04c.docx.a")) returned 1 [0056.497] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", lpFilePart=0x0) returned 0x2f [0056.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.497] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\o7lajrgccq1t qzj3.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.497] GetFileType (hFile=0x2e4) returned 0x1 [0056.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.497] GetFileType (hFile=0x2e4) returned 0x1 [0056.497] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x60e2 [0056.497] ReadFile (in: hFile=0x2e4, lpBuffer=0x32faa14, nNumberOfBytesToRead=0x60e2, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32faa14*, lpNumberOfBytesRead=0x138e7fc*=0x60e2, lpOverlapped=0x0) returned 1 [0056.497] CloseHandle (hObject=0x2e4) returned 1 [0056.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.513] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.517] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", lpFilePart=0x0) returned 0x2f [0056.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\o7lajrgccq1t qzj3.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.518] GetFileType (hFile=0x2e4) returned 0x1 [0056.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.518] GetFileType (hFile=0x2e4) returned 0x1 [0056.518] WriteFile (in: hFile=0x2e4, lpBuffer=0x3365e0c*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3365e0c*, lpNumberOfBytesWritten=0x138e7f0*=0x60f0, lpOverlapped=0x0) returned 1 [0056.520] CloseHandle (hObject=0x2e4) returned 1 [0056.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt", lpFilePart=0x0) returned 0x2f [0056.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt.a", lpFilePart=0x0) returned 0x31 [0056.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\o7lajrgccq1t qzj3.ppt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac350ea0, ftCreationTime.dwHighDateTime=0x1d5ea71, ftLastAccessTime.dwLowDateTime=0xb6148010, ftLastAccessTime.dwHighDateTime=0x1d5ead8, ftLastWriteTime.dwLowDateTime=0xd2a320db, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x60f0)) returned 1 [0056.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.521] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\o7lajrgccq1t qzj3.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\O7LAjrgCCQ1T Qzj3.ppt.a" (normalized: "c:\\users\\fd1hvy\\documents\\o7lajrgccq1t qzj3.ppt.a")) returned 1 [0056.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", lpFilePart=0x0) returned 0x2d [0056.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt" (normalized: "c:\\users\\fd1hvy\\documents\\orf11e65l-wzgxt.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.522] GetFileType (hFile=0x2e4) returned 0x1 [0056.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.522] GetFileType (hFile=0x2e4) returned 0x1 [0056.522] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xf760 [0056.522] ReadFile (in: hFile=0x2e4, lpBuffer=0x336c35c, nNumberOfBytesToRead=0xf760, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x336c35c*, lpNumberOfBytesRead=0x138e7fc*=0xf760, lpOverlapped=0x0) returned 1 [0056.523] CloseHandle (hObject=0x2e4) returned 1 [0056.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.541] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.541] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", lpFilePart=0x0) returned 0x2d [0056.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt" (normalized: "c:\\users\\fd1hvy\\documents\\orf11e65l-wzgxt.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.542] GetFileType (hFile=0x2e4) returned 0x1 [0056.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.542] GetFileType (hFile=0x2e4) returned 0x1 [0056.542] WriteFile (in: hFile=0x2e4, lpBuffer=0x33e77a8*, nNumberOfBytesToWrite=0xf770, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e77a8*, lpNumberOfBytesWritten=0x138e7f0*=0xf770, lpOverlapped=0x0) returned 1 [0056.544] CloseHandle (hObject=0x2e4) returned 1 [0056.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt", lpFilePart=0x0) returned 0x2d [0056.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt.a", lpFilePart=0x0) returned 0x2f [0056.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt" (normalized: "c:\\users\\fd1hvy\\documents\\orf11e65l-wzgxt.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4818f0, ftCreationTime.dwHighDateTime=0x1d5e8d8, ftLastAccessTime.dwLowDateTime=0x54476900, ftLastAccessTime.dwHighDateTime=0x1d5e971, ftLastWriteTime.dwLowDateTime=0xd2a7e51d, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf770)) returned 1 [0056.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.546] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt" (normalized: "c:\\users\\fd1hvy\\documents\\orf11e65l-wzgxt.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ORf11e65l-wzgxT.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\orf11e65l-wzgxt.odt.a")) returned 1 [0056.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", lpFilePart=0x0) returned 0x26 [0056.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tzt4ovk.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.547] GetFileType (hFile=0x2e4) returned 0x1 [0056.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.547] GetFileType (hFile=0x2e4) returned 0x1 [0056.547] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x13d5f [0056.547] ReadFile (in: hFile=0x2e4, lpBuffer=0x33f734c, nNumberOfBytesToRead=0x13d5f, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33f734c*, lpNumberOfBytesRead=0x138e7fc*=0x13d5f, lpOverlapped=0x0) returned 1 [0056.548] CloseHandle (hObject=0x2e4) returned 1 [0056.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", lpFilePart=0x0) returned 0x26 [0056.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tzt4ovk.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.570] GetFileType (hFile=0x2e4) returned 0x1 [0056.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.570] GetFileType (hFile=0x2e4) returned 0x1 [0056.570] WriteFile (in: hFile=0x2e4, lpBuffer=0x347f96c*, nNumberOfBytesToWrite=0x13d60, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x347f96c*, lpNumberOfBytesWritten=0x138e7f0*=0x13d60, lpOverlapped=0x0) returned 1 [0056.574] CloseHandle (hObject=0x2e4) returned 1 [0056.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx", lpFilePart=0x0) returned 0x26 [0056.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx.a", lpFilePart=0x0) returned 0x28 [0056.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tzt4ovk.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6095df40, ftCreationTime.dwHighDateTime=0x1d5681e, ftLastAccessTime.dwLowDateTime=0xe358d230, ftLastAccessTime.dwHighDateTime=0x1d5ba1b, ftLastWriteTime.dwLowDateTime=0xd2acc4cf, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x13d60)) returned 1 [0056.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.577] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\tzt4ovk.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\TZT4Ovk.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\tzt4ovk.docx.a")) returned 1 [0056.578] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", lpFilePart=0x0) returned 0x33 [0056.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w8vjnhz 68_rzkabslfs.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.578] GetFileType (hFile=0x2e4) returned 0x1 [0056.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.578] GetFileType (hFile=0x2e4) returned 0x1 [0056.578] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x11d60 [0056.578] ReadFile (in: hFile=0x2e4, lpBuffer=0x3493af4, nNumberOfBytesToRead=0x11d60, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3493af4*, lpNumberOfBytesRead=0x138e7fc*=0x11d60, lpOverlapped=0x0) returned 1 [0056.578] CloseHandle (hObject=0x2e4) returned 1 [0056.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", lpFilePart=0x0) returned 0x33 [0056.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w8vjnhz 68_rzkabslfs.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.637] GetFileType (hFile=0x2e4) returned 0x1 [0056.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.637] GetFileType (hFile=0x2e4) returned 0x1 [0056.637] WriteFile (in: hFile=0x2e4, lpBuffer=0x331d5f0*, nNumberOfBytesToWrite=0x11d70, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x331d5f0*, lpNumberOfBytesWritten=0x138e7f0*=0x11d70, lpOverlapped=0x0) returned 1 [0056.640] CloseHandle (hObject=0x2e4) returned 1 [0056.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx", lpFilePart=0x0) returned 0x33 [0056.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx.a", lpFilePart=0x0) returned 0x35 [0056.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.642] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w8vjnhz 68_rzkabslfs.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5841f870, ftCreationTime.dwHighDateTime=0x1d5efc2, ftLastAccessTime.dwLowDateTime=0x650076f0, ftLastAccessTime.dwHighDateTime=0x1d57d07, ftLastWriteTime.dwLowDateTime=0xd2b63342, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11d70)) returned 1 [0056.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.642] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\w8vjnhz 68_rzkabslfs.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\w8vJNHz 68_RzkaBSlFS.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\w8vjnhz 68_rzkabslfs.xlsx.a")) returned 1 [0056.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", lpFilePart=0x0) returned 0x29 [0056.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0056.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_rtar0wlgzy.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.643] GetFileType (hFile=0x2e4) returned 0x1 [0056.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0056.643] GetFileType (hFile=0x2e4) returned 0x1 [0056.643] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xac76 [0056.643] ReadFile (in: hFile=0x2e4, lpBuffer=0x332f7d8, nNumberOfBytesToRead=0xac76, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x332f7d8*, lpNumberOfBytesRead=0x138e7fc*=0xac76, lpOverlapped=0x0) returned 1 [0056.643] CloseHandle (hObject=0x2e4) returned 1 [0056.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0056.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0056.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", lpFilePart=0x0) returned 0x29 [0056.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0056.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_rtar0wlgzy.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.672] GetFileType (hFile=0x2e4) returned 0x1 [0056.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0056.672] GetFileType (hFile=0x2e4) returned 0x1 [0056.672] WriteFile (in: hFile=0x2e4, lpBuffer=0x339ccb4*, nNumberOfBytesToWrite=0xac80, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x339ccb4*, lpNumberOfBytesWritten=0x138e7f0*=0xac80, lpOverlapped=0x0) returned 1 [0056.673] CloseHandle (hObject=0x2e4) returned 1 [0056.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf", lpFilePart=0x0) returned 0x29 [0056.675] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf.a", lpFilePart=0x0) returned 0x2b [0056.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0056.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_rtar0wlgzy.rtf"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e484590, ftCreationTime.dwHighDateTime=0x1d5eda4, ftLastAccessTime.dwLowDateTime=0xbbb9ea60, ftLastAccessTime.dwHighDateTime=0x1d5e857, ftLastWriteTime.dwLowDateTime=0xd2baf741, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xac80)) returned 1 [0056.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0056.675] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\_rtar0wlgzy.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_rTaR0wLgZy.rtf.a" (normalized: "c:\\users\\fd1hvy\\documents\\_rtar0wlgzy.rtf.a")) returned 1 [0056.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.676] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0056.676] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f8) returned 1 [0056.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0056.703] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f8) returned 1 [0056.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0056.705] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d9b8 [0056.706] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.706] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.706] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0056.706] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0056.706] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0056.706] FindClose (in: hFindFile=0x169d9b8 | out: hFindFile=0x169d9b8) returned 1 [0056.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0056.707] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcf8 [0056.707] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.707] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.707] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0056.707] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0056.707] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.707] FindClose (in: hFindFile=0x169dcf8 | out: hFindFile=0x169dcf8) returned 1 [0056.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0056.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0056.708] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0056.708] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.709] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0056.709] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.709] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0056.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0056.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0056.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0056.709] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0056.709] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0056.709] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.709] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0056.710] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0056.710] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0056.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0056.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0056.710] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0056.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0056.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.710] GetFileType (hFile=0x2e4) returned 0x1 [0056.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0056.710] GetFileType (hFile=0x2e4) returned 0x1 [0056.710] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x74e6 [0056.710] ReadFile (in: hFile=0x2e4, lpBuffer=0x33acb20, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33acb20*, lpNumberOfBytesRead=0x138e714*=0x74e6, lpOverlapped=0x0) returned 1 [0056.737] CloseHandle (hObject=0x2e4) returned 1 [0056.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0056.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0056.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0056.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0056.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0056.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0056.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0056.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138c9f0) returned 1 [0056.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.827] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0056.827] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0056.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f8) returned 1 [0056.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0056.828] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d9b8 [0056.828] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.829] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0056.829] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.829] FindClose (in: hFindFile=0x169d9b8 | out: hFindFile=0x169d9b8) returned 1 [0056.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0056.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169ddb8 [0056.829] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.829] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0056.830] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0056.830] FindClose (in: hFindFile=0x169ddb8 | out: hFindFile=0x169ddb8) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS", lpFilePart=0x0) returned 0x23 [0056.830] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcf8 [0056.830] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.830] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H_3XcyOgEOX8weMmYZ", cAlternateFileName="H_3XCY~1")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bbc8d0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x502e30c0, ftLastAccessTime.dwHighDateTime=0x1d5e880, ftLastWriteTime.dwLowDateTime=0x502e30c0, ftLastWriteTime.dwHighDateTime=0x1d5e880, nFileSizeHigh=0x0, nFileSizeLow=0x1cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="mR0Z4dQEnFd3hpw.ppt", cAlternateFileName="MR0Z4D~1.PPT")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cbd0b0, ftCreationTime.dwHighDateTime=0x1d5f0e0, ftLastAccessTime.dwLowDateTime=0x7f9afd60, ftLastAccessTime.dwHighDateTime=0x1d5eba6, ftLastWriteTime.dwLowDateTime=0x7f9afd60, ftLastWriteTime.dwHighDateTime=0x1d5eba6, nFileSizeHigh=0x0, nFileSizeLow=0x18810, dwReserved0=0x0, dwReserved1=0x0, cFileName="PwlfOCUlPSFxnHHg1.docx", cAlternateFileName="PWLFOC~1.DOC")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa18bdc0, ftCreationTime.dwHighDateTime=0x1d5e372, ftLastAccessTime.dwLowDateTime=0x999d3110, ftLastAccessTime.dwHighDateTime=0x1d5ea1b, ftLastWriteTime.dwLowDateTime=0x999d3110, ftLastWriteTime.dwHighDateTime=0x1d5ea1b, nFileSizeHigh=0x0, nFileSizeLow=0x5b06, dwReserved0=0x0, dwReserved1=0x0, cFileName="TNKLVGUYmxuf.pptx", cAlternateFileName="TNKLVG~1.PPT")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad18c4d0, ftCreationTime.dwHighDateTime=0x1d5e5c4, ftLastAccessTime.dwLowDateTime=0x7dd25e00, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x7dd25e00, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0x15e3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="T_LZ89fTlsG.ots", cAlternateFileName="T_LZ89~1.OTS")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b673340, ftCreationTime.dwHighDateTime=0x1d5ed84, ftLastAccessTime.dwLowDateTime=0xab6b9a30, ftLastAccessTime.dwHighDateTime=0x1d5e7aa, ftLastWriteTime.dwLowDateTime=0xab6b9a30, ftLastWriteTime.dwHighDateTime=0x1d5e7aa, nFileSizeHigh=0x0, nFileSizeLow=0x13254, dwReserved0=0x0, dwReserved1=0x0, cFileName="vaiz.odt", cAlternateFileName="")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a67dcd0, ftCreationTime.dwHighDateTime=0x1d5e43d, ftLastAccessTime.dwLowDateTime=0x82b50770, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x82b50770, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x14849, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjR74yBiX0xOA.pptx", cAlternateFileName="YJR74Y~1.PPT")) returned 1 [0056.831] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.831] FindClose (in: hFindFile=0x169dcf8 | out: hFindFile=0x169dcf8) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0056.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS", lpFilePart=0x0) returned 0x23 [0056.832] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcf8 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabd82d80, ftCreationTime.dwHighDateTime=0x1d5ed22, ftLastAccessTime.dwLowDateTime=0xf1710940, ftLastAccessTime.dwHighDateTime=0x1d5e9bf, ftLastWriteTime.dwLowDateTime=0xf1710940, ftLastWriteTime.dwHighDateTime=0x1d5e9bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H_3XcyOgEOX8weMmYZ", cAlternateFileName="H_3XCY~1")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bbc8d0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x502e30c0, ftLastAccessTime.dwHighDateTime=0x1d5e880, ftLastWriteTime.dwLowDateTime=0x502e30c0, ftLastWriteTime.dwHighDateTime=0x1d5e880, nFileSizeHigh=0x0, nFileSizeLow=0x1cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="mR0Z4dQEnFd3hpw.ppt", cAlternateFileName="MR0Z4D~1.PPT")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cbd0b0, ftCreationTime.dwHighDateTime=0x1d5f0e0, ftLastAccessTime.dwLowDateTime=0x7f9afd60, ftLastAccessTime.dwHighDateTime=0x1d5eba6, ftLastWriteTime.dwLowDateTime=0x7f9afd60, ftLastWriteTime.dwHighDateTime=0x1d5eba6, nFileSizeHigh=0x0, nFileSizeLow=0x18810, dwReserved0=0x0, dwReserved1=0x0, cFileName="PwlfOCUlPSFxnHHg1.docx", cAlternateFileName="PWLFOC~1.DOC")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa18bdc0, ftCreationTime.dwHighDateTime=0x1d5e372, ftLastAccessTime.dwLowDateTime=0x999d3110, ftLastAccessTime.dwHighDateTime=0x1d5ea1b, ftLastWriteTime.dwLowDateTime=0x999d3110, ftLastWriteTime.dwHighDateTime=0x1d5ea1b, nFileSizeHigh=0x0, nFileSizeLow=0x5b06, dwReserved0=0x0, dwReserved1=0x0, cFileName="TNKLVGUYmxuf.pptx", cAlternateFileName="TNKLVG~1.PPT")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad18c4d0, ftCreationTime.dwHighDateTime=0x1d5e5c4, ftLastAccessTime.dwLowDateTime=0x7dd25e00, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0x7dd25e00, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0x15e3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="T_LZ89fTlsG.ots", cAlternateFileName="T_LZ89~1.OTS")) returned 1 [0056.832] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b673340, ftCreationTime.dwHighDateTime=0x1d5ed84, ftLastAccessTime.dwLowDateTime=0xab6b9a30, ftLastAccessTime.dwHighDateTime=0x1d5e7aa, ftLastWriteTime.dwLowDateTime=0xab6b9a30, ftLastWriteTime.dwHighDateTime=0x1d5e7aa, nFileSizeHigh=0x0, nFileSizeLow=0x13254, dwReserved0=0x0, dwReserved1=0x0, cFileName="vaiz.odt", cAlternateFileName="")) returned 1 [0056.833] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a67dcd0, ftCreationTime.dwHighDateTime=0x1d5e43d, ftLastAccessTime.dwLowDateTime=0x82b50770, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x82b50770, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x14849, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjR74yBiX0xOA.pptx", cAlternateFileName="YJR74Y~1.PPT")) returned 1 [0056.833] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a67dcd0, ftCreationTime.dwHighDateTime=0x1d5e43d, ftLastAccessTime.dwLowDateTime=0x82b50770, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0x82b50770, ftLastWriteTime.dwHighDateTime=0x1d5ebce, nFileSizeHigh=0x0, nFileSizeLow=0x14849, dwReserved0=0x0, dwReserved1=0x0, cFileName="yjR74yBiX0xOA.pptx", cAlternateFileName="YJR74Y~1.PPT")) returned 0 [0056.833] FindClose (in: hFindFile=0x169dcf8 | out: hFindFile=0x169dcf8) returned 1 [0056.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0056.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0056.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", lpFilePart=0x0) returned 0x37 [0056.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0056.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\mr0z4dqenfd3hpw.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0056.833] GetFileType (hFile=0x2e4) returned 0x1 [0056.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0056.833] GetFileType (hFile=0x2e4) returned 0x1 [0056.833] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x1cca [0056.833] ReadFile (in: hFile=0x2e4, lpBuffer=0x3429558, nNumberOfBytesToRead=0x1cca, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x3429558*, lpNumberOfBytesRead=0x138e788*=0x1cca, lpOverlapped=0x0) returned 1 [0056.834] CloseHandle (hObject=0x2e4) returned 1 [0057.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0057.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0057.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", lpFilePart=0x0) returned 0x37 [0057.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0057.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\mr0z4dqenfd3hpw.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.045] GetFileType (hFile=0x2e4) returned 0x1 [0057.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0057.045] GetFileType (hFile=0x2e4) returned 0x1 [0057.045] WriteFile (in: hFile=0x2e4, lpBuffer=0x347f354*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x347f354*, lpNumberOfBytesWritten=0x138e77c*=0x1cd0, lpOverlapped=0x0) returned 1 [0057.046] CloseHandle (hObject=0x2e4) returned 1 [0057.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt", lpFilePart=0x0) returned 0x37 [0057.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt.a", lpFilePart=0x0) returned 0x39 [0057.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0057.047] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\mr0z4dqenfd3hpw.ppt"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bbc8d0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x502e30c0, ftLastAccessTime.dwHighDateTime=0x1d5e880, ftLastWriteTime.dwLowDateTime=0xd2f430ee, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x1cd0)) returned 1 [0057.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0057.047] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\mr0z4dqenfd3hpw.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\mR0Z4dQEnFd3hpw.ppt.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\mr0z4dqenfd3hpw.ppt.a")) returned 1 [0057.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", lpFilePart=0x0) returned 0x3a [0057.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.048] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\pwlfoculpsfxnhhg1.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.048] GetFileType (hFile=0x2e4) returned 0x1 [0057.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.048] GetFileType (hFile=0x2e4) returned 0x1 [0057.048] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x18810 [0057.048] ReadFile (in: hFile=0x2e4, lpBuffer=0x43a7b10, nNumberOfBytesToRead=0x18810, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x43a7b10*, lpNumberOfBytesRead=0x138e788*=0x18810, lpOverlapped=0x0) returned 1 [0057.049] CloseHandle (hObject=0x2e4) returned 1 [0057.162] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0057.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0057.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", lpFilePart=0x0) returned 0x3a [0057.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0057.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\pwlfoculpsfxnhhg1.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.164] GetFileType (hFile=0x2e4) returned 0x1 [0057.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0057.164] GetFileType (hFile=0x2e4) returned 0x1 [0057.164] WriteFile (in: hFile=0x2e4, lpBuffer=0x44223e0*, nNumberOfBytesToWrite=0x18820, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x44223e0*, lpNumberOfBytesWritten=0x138e77c*=0x18820, lpOverlapped=0x0) returned 1 [0057.167] CloseHandle (hObject=0x2e4) returned 1 [0057.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx", lpFilePart=0x0) returned 0x3a [0057.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx.a", lpFilePart=0x0) returned 0x3c [0057.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0057.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\pwlfoculpsfxnhhg1.docx"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cbd0b0, ftCreationTime.dwHighDateTime=0x1d5f0e0, ftLastAccessTime.dwLowDateTime=0x7f9afd60, ftLastAccessTime.dwHighDateTime=0x1d5eba6, ftLastWriteTime.dwLowDateTime=0xd304e318, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18820)) returned 1 [0057.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0057.170] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\pwlfoculpsfxnhhg1.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\PwlfOCUlPSFxnHHg1.docx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\pwlfoculpsfxnhhg1.docx.a")) returned 1 [0057.217] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", lpFilePart=0x0) returned 0x35 [0057.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.217] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\tnklvguymxuf.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.217] GetFileType (hFile=0x2e4) returned 0x1 [0057.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.217] GetFileType (hFile=0x2e4) returned 0x1 [0057.218] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x5b06 [0057.218] ReadFile (in: hFile=0x2e4, lpBuffer=0x32be1a4, nNumberOfBytesToRead=0x5b06, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32be1a4*, lpNumberOfBytesRead=0x138e788*=0x5b06, lpOverlapped=0x0) returned 1 [0057.218] CloseHandle (hObject=0x2e4) returned 1 [0057.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0057.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0057.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", lpFilePart=0x0) returned 0x35 [0057.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0057.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\tnklvguymxuf.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.234] GetFileType (hFile=0x2e4) returned 0x1 [0057.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0057.234] GetFileType (hFile=0x2e4) returned 0x1 [0057.234] WriteFile (in: hFile=0x2e4, lpBuffer=0x332783c*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x332783c*, lpNumberOfBytesWritten=0x138e77c*=0x5b10, lpOverlapped=0x0) returned 1 [0057.235] CloseHandle (hObject=0x2e4) returned 1 [0057.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx", lpFilePart=0x0) returned 0x35 [0057.240] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx.a", lpFilePart=0x0) returned 0x37 [0057.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0057.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\tnklvguymxuf.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa18bdc0, ftCreationTime.dwHighDateTime=0x1d5e372, ftLastAccessTime.dwLowDateTime=0x999d3110, ftLastAccessTime.dwHighDateTime=0x1d5ea1b, ftLastWriteTime.dwLowDateTime=0xd310cc3c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5b10)) returned 1 [0057.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0057.240] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\tnklvguymxuf.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\TNKLVGUYmxuf.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\tnklvguymxuf.pptx.a")) returned 1 [0057.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", lpFilePart=0x0) returned 0x2c [0057.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.241] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\vaiz.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.241] GetFileType (hFile=0x2e4) returned 0x1 [0057.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.241] GetFileType (hFile=0x2e4) returned 0x1 [0057.241] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x13254 [0057.241] ReadFile (in: hFile=0x2e4, lpBuffer=0x332d7d8, nNumberOfBytesToRead=0x13254, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x332d7d8*, lpNumberOfBytesRead=0x138e788*=0x13254, lpOverlapped=0x0) returned 1 [0057.241] CloseHandle (hObject=0x2e4) returned 1 [0057.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0057.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0057.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", lpFilePart=0x0) returned 0x2c [0057.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0057.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\vaiz.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.261] GetFileType (hFile=0x2e4) returned 0x1 [0057.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0057.261] GetFileType (hFile=0x2e4) returned 0x1 [0057.261] WriteFile (in: hFile=0x2e4, lpBuffer=0x33b3cf4*, nNumberOfBytesToWrite=0x13260, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33b3cf4*, lpNumberOfBytesWritten=0x138e77c*=0x13260, lpOverlapped=0x0) returned 1 [0057.263] CloseHandle (hObject=0x2e4) returned 1 [0057.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt", lpFilePart=0x0) returned 0x2c [0057.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt.a", lpFilePart=0x0) returned 0x2e [0057.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0057.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\vaiz.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b673340, ftCreationTime.dwHighDateTime=0x1d5ed84, ftLastAccessTime.dwLowDateTime=0xab6b9a30, ftLastAccessTime.dwHighDateTime=0x1d5e7aa, ftLastWriteTime.dwLowDateTime=0xd326420d, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x13260)) returned 1 [0057.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0057.376] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\vaiz.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\vaiz.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\vaiz.odt.a")) returned 1 [0057.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", lpFilePart=0x0) returned 0x36 [0057.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.376] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\yjr74ybix0xoa.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.377] GetFileType (hFile=0x2e4) returned 0x1 [0057.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.377] GetFileType (hFile=0x2e4) returned 0x1 [0057.377] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x14849 [0057.377] ReadFile (in: hFile=0x2e4, lpBuffer=0x33c73a0, nNumberOfBytesToRead=0x14849, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x33c73a0*, lpNumberOfBytesRead=0x138e788*=0x14849, lpOverlapped=0x0) returned 1 [0057.377] CloseHandle (hObject=0x2e4) returned 1 [0057.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0057.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0057.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", lpFilePart=0x0) returned 0x36 [0057.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0057.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\yjr74ybix0xoa.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.395] GetFileType (hFile=0x2e4) returned 0x1 [0057.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0057.395] GetFileType (hFile=0x2e4) returned 0x1 [0057.395] WriteFile (in: hFile=0x2e4, lpBuffer=0x3451a90*, nNumberOfBytesToWrite=0x14850, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x3451a90*, lpNumberOfBytesWritten=0x138e77c*=0x14850, lpOverlapped=0x0) returned 1 [0057.397] CloseHandle (hObject=0x2e4) returned 1 [0057.399] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx", lpFilePart=0x0) returned 0x36 [0057.399] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx.a", lpFilePart=0x0) returned 0x38 [0057.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0057.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\yjr74ybix0xoa.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a67dcd0, ftCreationTime.dwHighDateTime=0x1d5e43d, ftLastAccessTime.dwLowDateTime=0x82b50770, ftLastAccessTime.dwHighDateTime=0x1d5ebce, ftLastWriteTime.dwLowDateTime=0xd328a428, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x14850)) returned 1 [0057.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0057.399] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\yjr74ybix0xoa.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\yjR74yBiX0xOA.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\yjr74ybix0xoa.pptx.a")) returned 1 [0057.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0057.400] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ", lpFilePart=0x0) returned 0x36 [0057.400] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d938 [0057.400] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.400] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c7a0930, ftCreationTime.dwHighDateTime=0x1d5e109, ftLastAccessTime.dwLowDateTime=0x7a2da580, ftLastAccessTime.dwHighDateTime=0x1d5f105, ftLastWriteTime.dwLowDateTime=0x7a2da580, ftLastWriteTime.dwHighDateTime=0x1d5f105, nFileSizeHigh=0x0, nFileSizeLow=0x141c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJ1ohevyYPMWq1qc1.doc", cAlternateFileName="CJ1OHE~1.DOC")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HqVun79_LztQd", cAlternateFileName="HQVUN7~1")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3275d6b0, ftCreationTime.dwHighDateTime=0x1d5f10d, ftLastAccessTime.dwLowDateTime=0x46eb5b30, ftLastAccessTime.dwHighDateTime=0x1d5e5ad, ftLastWriteTime.dwLowDateTime=0x46eb5b30, ftLastWriteTime.dwHighDateTime=0x1d5e5ad, nFileSizeHigh=0x0, nFileSizeLow=0x828f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxC5EM1.csv", cAlternateFileName="")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4457e690, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x606d2220, ftLastAccessTime.dwHighDateTime=0x1d5e781, ftLastWriteTime.dwLowDateTime=0x606d2220, ftLastWriteTime.dwHighDateTime=0x1d5e781, nFileSizeHigh=0x0, nFileSizeLow=0x13bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="LN9x2L_FAc8UbDgsN4ej.pdf", cAlternateFileName="LN9X2L~1.PDF")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdb4800, ftCreationTime.dwHighDateTime=0x1d5e547, ftLastAccessTime.dwLowDateTime=0x14b0f380, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0x14b0f380, ftLastWriteTime.dwHighDateTime=0x1d5f018, nFileSizeHigh=0x0, nFileSizeLow=0xd75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9qjHW7w4yW.doc", cAlternateFileName="M9QJHW~1.DOC")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71888200, ftCreationTime.dwHighDateTime=0x1d5e9bd, ftLastAccessTime.dwLowDateTime=0xaec546b0, ftLastAccessTime.dwHighDateTime=0x1d5e811, ftLastWriteTime.dwLowDateTime=0xaec546b0, ftLastWriteTime.dwHighDateTime=0x1d5e811, nFileSizeHigh=0x0, nFileSizeLow=0x36c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="O2pIFAXIeiKv.odt", cAlternateFileName="O2PIFA~1.ODT")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd990ceb0, ftCreationTime.dwHighDateTime=0x1d5ec5c, ftLastAccessTime.dwLowDateTime=0x7d41e7e0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0x7d41e7e0, ftLastWriteTime.dwHighDateTime=0x1d5ed77, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcZtVTb7DpoRLydqL.xlsx", cAlternateFileName="VCZTVT~1.XLS")) returned 1 [0057.401] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_BaF8C5_MTcPdIH1ZGwc", cAlternateFileName="_BAF8C~1")) returned 1 [0057.402] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cd60b0, ftCreationTime.dwHighDateTime=0x1d5eadd, ftLastAccessTime.dwLowDateTime=0x3ff4cca0, ftLastAccessTime.dwHighDateTime=0x1d5f02d, ftLastWriteTime.dwLowDateTime=0x3ff4cca0, ftLastWriteTime.dwHighDateTime=0x1d5f02d, nFileSizeHigh=0x0, nFileSizeLow=0xc1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WkFoo.pptx", cAlternateFileName="_WKFOO~1.PPT")) returned 1 [0057.402] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.402] FindClose (in: hFindFile=0x169d938 | out: hFindFile=0x169d938) returned 1 [0057.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0057.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0057.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0057.402] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ", lpFilePart=0x0) returned 0x36 [0057.402] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d938 [0057.402] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaccf8d30, ftCreationTime.dwHighDateTime=0x1d5e0ea, ftLastAccessTime.dwLowDateTime=0x4b64c260, ftLastAccessTime.dwHighDateTime=0x1d5e8ef, ftLastWriteTime.dwLowDateTime=0x4b64c260, ftLastWriteTime.dwHighDateTime=0x1d5e8ef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.402] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c7a0930, ftCreationTime.dwHighDateTime=0x1d5e109, ftLastAccessTime.dwLowDateTime=0x7a2da580, ftLastAccessTime.dwHighDateTime=0x1d5f105, ftLastWriteTime.dwLowDateTime=0x7a2da580, ftLastWriteTime.dwHighDateTime=0x1d5f105, nFileSizeHigh=0x0, nFileSizeLow=0x141c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJ1ohevyYPMWq1qc1.doc", cAlternateFileName="CJ1OHE~1.DOC")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HqVun79_LztQd", cAlternateFileName="HQVUN7~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3275d6b0, ftCreationTime.dwHighDateTime=0x1d5f10d, ftLastAccessTime.dwLowDateTime=0x46eb5b30, ftLastAccessTime.dwHighDateTime=0x1d5e5ad, ftLastWriteTime.dwLowDateTime=0x46eb5b30, ftLastWriteTime.dwHighDateTime=0x1d5e5ad, nFileSizeHigh=0x0, nFileSizeLow=0x828f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HxC5EM1.csv", cAlternateFileName="")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4457e690, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x606d2220, ftLastAccessTime.dwHighDateTime=0x1d5e781, ftLastWriteTime.dwLowDateTime=0x606d2220, ftLastWriteTime.dwHighDateTime=0x1d5e781, nFileSizeHigh=0x0, nFileSizeLow=0x13bac, dwReserved0=0x0, dwReserved1=0x0, cFileName="LN9x2L_FAc8UbDgsN4ej.pdf", cAlternateFileName="LN9X2L~1.PDF")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdb4800, ftCreationTime.dwHighDateTime=0x1d5e547, ftLastAccessTime.dwLowDateTime=0x14b0f380, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0x14b0f380, ftLastWriteTime.dwHighDateTime=0x1d5f018, nFileSizeHigh=0x0, nFileSizeLow=0xd75a, dwReserved0=0x0, dwReserved1=0x0, cFileName="M9qjHW7w4yW.doc", cAlternateFileName="M9QJHW~1.DOC")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71888200, ftCreationTime.dwHighDateTime=0x1d5e9bd, ftLastAccessTime.dwLowDateTime=0xaec546b0, ftLastAccessTime.dwHighDateTime=0x1d5e811, ftLastWriteTime.dwLowDateTime=0xaec546b0, ftLastWriteTime.dwHighDateTime=0x1d5e811, nFileSizeHigh=0x0, nFileSizeLow=0x36c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="O2pIFAXIeiKv.odt", cAlternateFileName="O2PIFA~1.ODT")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd990ceb0, ftCreationTime.dwHighDateTime=0x1d5ec5c, ftLastAccessTime.dwLowDateTime=0x7d41e7e0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0x7d41e7e0, ftLastWriteTime.dwHighDateTime=0x1d5ed77, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcZtVTb7DpoRLydqL.xlsx", cAlternateFileName="VCZTVT~1.XLS")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_BaF8C5_MTcPdIH1ZGwc", cAlternateFileName="_BAF8C~1")) returned 1 [0057.403] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cd60b0, ftCreationTime.dwHighDateTime=0x1d5eadd, ftLastAccessTime.dwLowDateTime=0x3ff4cca0, ftLastAccessTime.dwHighDateTime=0x1d5f02d, ftLastWriteTime.dwLowDateTime=0x3ff4cca0, ftLastWriteTime.dwHighDateTime=0x1d5f02d, nFileSizeHigh=0x0, nFileSizeLow=0xc1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WkFoo.pptx", cAlternateFileName="_WKFOO~1.PPT")) returned 1 [0057.404] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cd60b0, ftCreationTime.dwHighDateTime=0x1d5eadd, ftLastAccessTime.dwLowDateTime=0x3ff4cca0, ftLastAccessTime.dwHighDateTime=0x1d5f02d, ftLastWriteTime.dwLowDateTime=0x3ff4cca0, ftLastWriteTime.dwHighDateTime=0x1d5f02d, nFileSizeHigh=0x0, nFileSizeLow=0xc1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_WkFoo.pptx", cAlternateFileName="_WKFOO~1.PPT")) returned 0 [0057.404] FindClose (in: hFindFile=0x169d938 | out: hFindFile=0x169d938) returned 1 [0057.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0057.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0057.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", lpFilePart=0x0) returned 0x4c [0057.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\cj1ohevyypmwq1qc1.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.406] GetFileType (hFile=0x2e4) returned 0x1 [0057.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.406] GetFileType (hFile=0x2e4) returned 0x1 [0057.406] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x141c8 [0057.406] ReadFile (in: hFile=0x2e4, lpBuffer=0x34697ac, nNumberOfBytesToRead=0x141c8, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x34697ac*, lpNumberOfBytesRead=0x138e714*=0x141c8, lpOverlapped=0x0) returned 1 [0057.407] CloseHandle (hObject=0x2e4) returned 1 [0057.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", lpFilePart=0x0) returned 0x4c [0057.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\cj1ohevyypmwq1qc1.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.544] GetFileType (hFile=0x2e4) returned 0x1 [0057.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.544] GetFileType (hFile=0x2e4) returned 0x1 [0057.544] WriteFile (in: hFile=0x2e4, lpBuffer=0x330732c*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x330732c*, lpNumberOfBytesWritten=0x138e708*=0x141d0, lpOverlapped=0x0) returned 1 [0057.640] CloseHandle (hObject=0x2e4) returned 1 [0057.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc", lpFilePart=0x0) returned 0x4c [0057.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc.a", lpFilePart=0x0) returned 0x4e [0057.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\cj1ohevyypmwq1qc1.doc"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c7a0930, ftCreationTime.dwHighDateTime=0x1d5e109, ftLastAccessTime.dwLowDateTime=0x7a2da580, ftLastAccessTime.dwHighDateTime=0x1d5f105, ftLastWriteTime.dwLowDateTime=0xd34ec6ea, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x141d0)) returned 1 [0057.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.643] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\cj1ohevyypmwq1qc1.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\CJ1ohevyYPMWq1qc1.doc.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\cj1ohevyypmwq1qc1.doc.a")) returned 1 [0057.643] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", lpFilePart=0x0) returned 0x42 [0057.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hxc5em1.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.643] GetFileType (hFile=0x2e4) returned 0x1 [0057.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.644] GetFileType (hFile=0x2e4) returned 0x1 [0057.644] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x828f [0057.644] ReadFile (in: hFile=0x2e4, lpBuffer=0x331ba68, nNumberOfBytesToRead=0x828f, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x331ba68*, lpNumberOfBytesRead=0x138e714*=0x828f, lpOverlapped=0x0) returned 1 [0057.644] CloseHandle (hObject=0x2e4) returned 1 [0057.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", lpFilePart=0x0) returned 0x42 [0057.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.661] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hxc5em1.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.662] GetFileType (hFile=0x2e4) returned 0x1 [0057.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.662] GetFileType (hFile=0x2e4) returned 0x1 [0057.662] WriteFile (in: hFile=0x2e4, lpBuffer=0x3391680*, nNumberOfBytesToWrite=0x8290, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x3391680*, lpNumberOfBytesWritten=0x138e708*=0x8290, lpOverlapped=0x0) returned 1 [0057.663] CloseHandle (hObject=0x2e4) returned 1 [0057.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv", lpFilePart=0x0) returned 0x42 [0057.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv.a", lpFilePart=0x0) returned 0x44 [0057.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hxc5em1.csv"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3275d6b0, ftCreationTime.dwHighDateTime=0x1d5f10d, ftLastAccessTime.dwLowDateTime=0x46eb5b30, ftLastAccessTime.dwHighDateTime=0x1d5e5ad, ftLastWriteTime.dwLowDateTime=0xd3512a6a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8290)) returned 1 [0057.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.665] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hxc5em1.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HxC5EM1.csv.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hxc5em1.csv.a")) returned 1 [0057.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", lpFilePart=0x0) returned 0x4f [0057.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\ln9x2l_fac8ubdgsn4ej.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.665] GetFileType (hFile=0x2e4) returned 0x1 [0057.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.666] GetFileType (hFile=0x2e4) returned 0x1 [0057.666] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x13bac [0057.666] ReadFile (in: hFile=0x2e4, lpBuffer=0x3399e4c, nNumberOfBytesToRead=0x13bac, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x3399e4c*, lpNumberOfBytesRead=0x138e714*=0x13bac, lpOverlapped=0x0) returned 1 [0057.666] CloseHandle (hObject=0x2e4) returned 1 [0057.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", lpFilePart=0x0) returned 0x4f [0057.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\ln9x2l_fac8ubdgsn4ej.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.685] GetFileType (hFile=0x2e4) returned 0x1 [0057.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.685] GetFileType (hFile=0x2e4) returned 0x1 [0057.685] WriteFile (in: hFile=0x2e4, lpBuffer=0x3421f58*, nNumberOfBytesToWrite=0x13bb0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x3421f58*, lpNumberOfBytesWritten=0x138e708*=0x13bb0, lpOverlapped=0x0) returned 1 [0057.765] CloseHandle (hObject=0x2e4) returned 1 [0057.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf", lpFilePart=0x0) returned 0x4f [0057.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf.a", lpFilePart=0x0) returned 0x51 [0057.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\ln9x2l_fac8ubdgsn4ej.pdf"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4457e690, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x606d2220, ftLastAccessTime.dwHighDateTime=0x1d5e781, ftLastWriteTime.dwLowDateTime=0xd361da8f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x13bb0)) returned 1 [0057.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.768] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\ln9x2l_fac8ubdgsn4ej.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\LN9x2L_FAc8UbDgsN4ej.pdf.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\ln9x2l_fac8ubdgsn4ej.pdf.a")) returned 1 [0057.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", lpFilePart=0x0) returned 0x46 [0057.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\m9qjhw7w4yw.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.769] GetFileType (hFile=0x2e4) returned 0x1 [0057.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.769] GetFileType (hFile=0x2e4) returned 0x1 [0057.769] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xd75a [0057.769] ReadFile (in: hFile=0x2e4, lpBuffer=0x343609c, nNumberOfBytesToRead=0xd75a, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x343609c*, lpNumberOfBytesRead=0x138e714*=0xd75a, lpOverlapped=0x0) returned 1 [0057.769] CloseHandle (hObject=0x2e4) returned 1 [0057.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", lpFilePart=0x0) returned 0x46 [0057.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.786] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\m9qjhw7w4yw.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.787] GetFileType (hFile=0x2e4) returned 0x1 [0057.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.787] GetFileType (hFile=0x2e4) returned 0x1 [0057.787] WriteFile (in: hFile=0x2e4, lpBuffer=0x34ab4bc*, nNumberOfBytesToWrite=0xd760, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x34ab4bc*, lpNumberOfBytesWritten=0x138e708*=0xd760, lpOverlapped=0x0) returned 1 [0057.788] CloseHandle (hObject=0x2e4) returned 1 [0057.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc", lpFilePart=0x0) returned 0x46 [0057.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc.a", lpFilePart=0x0) returned 0x48 [0057.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\m9qjhw7w4yw.doc"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafdb4800, ftCreationTime.dwHighDateTime=0x1d5e547, ftLastAccessTime.dwLowDateTime=0x14b0f380, ftLastAccessTime.dwHighDateTime=0x1d5f018, ftLastWriteTime.dwLowDateTime=0xd3643cc6, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd760)) returned 1 [0057.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.790] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\m9qjhw7w4yw.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\M9qjHW7w4yW.doc.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\m9qjhw7w4yw.doc.a")) returned 1 [0057.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", lpFilePart=0x0) returned 0x47 [0057.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\o2pifaxieikv.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.791] GetFileType (hFile=0x2e4) returned 0x1 [0057.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.791] GetFileType (hFile=0x2e4) returned 0x1 [0057.791] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x36c7 [0057.796] ReadFile (in: hFile=0x2e4, lpBuffer=0x329c9d0, nNumberOfBytesToRead=0x36c7, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x329c9d0*, lpNumberOfBytesRead=0x138e714*=0x36c7, lpOverlapped=0x0) returned 1 [0057.796] CloseHandle (hObject=0x2e4) returned 1 [0057.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", lpFilePart=0x0) returned 0x47 [0057.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\o2pifaxieikv.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.904] GetFileType (hFile=0x2e4) returned 0x1 [0057.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.904] GetFileType (hFile=0x2e4) returned 0x1 [0057.904] WriteFile (in: hFile=0x2e4, lpBuffer=0x32fab28*, nNumberOfBytesToWrite=0x36d0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x32fab28*, lpNumberOfBytesWritten=0x138e708*=0x36d0, lpOverlapped=0x0) returned 1 [0057.905] CloseHandle (hObject=0x2e4) returned 1 [0057.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt", lpFilePart=0x0) returned 0x47 [0057.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt.a", lpFilePart=0x0) returned 0x49 [0057.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\o2pifaxieikv.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71888200, ftCreationTime.dwHighDateTime=0x1d5e9bd, ftLastAccessTime.dwLowDateTime=0xaec546b0, ftLastAccessTime.dwHighDateTime=0x1d5e811, ftLastWriteTime.dwLowDateTime=0xd377538e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x36d0)) returned 1 [0057.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.911] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\o2pifaxieikv.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\O2pIFAXIeiKv.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\o2pifaxieikv.odt.a")) returned 1 [0057.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", lpFilePart=0x0) returned 0x4d [0057.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\vcztvtb7dporlydql.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.911] GetFileType (hFile=0x2e4) returned 0x1 [0057.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.911] GetFileType (hFile=0x2e4) returned 0x1 [0057.911] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x8cda [0057.911] ReadFile (in: hFile=0x2e4, lpBuffer=0x32fe758, nNumberOfBytesToRead=0x8cda, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x32fe758*, lpNumberOfBytesRead=0x138e714*=0x8cda, lpOverlapped=0x0) returned 1 [0057.912] CloseHandle (hObject=0x2e4) returned 1 [0057.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", lpFilePart=0x0) returned 0x4d [0057.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\vcztvtb7dporlydql.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.976] GetFileType (hFile=0x2e4) returned 0x1 [0057.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.976] GetFileType (hFile=0x2e4) returned 0x1 [0057.976] WriteFile (in: hFile=0x2e4, lpBuffer=0x33775a4*, nNumberOfBytesToWrite=0x8ce0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x33775a4*, lpNumberOfBytesWritten=0x138e708*=0x8ce0, lpOverlapped=0x0) returned 1 [0057.978] CloseHandle (hObject=0x2e4) returned 1 [0057.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx", lpFilePart=0x0) returned 0x4d [0057.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx.a", lpFilePart=0x0) returned 0x4f [0057.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0057.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\vcztvtb7dporlydql.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd990ceb0, ftCreationTime.dwHighDateTime=0x1d5ec5c, ftLastAccessTime.dwLowDateTime=0x7d41e7e0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0xd380d87f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8ce0)) returned 1 [0057.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0057.980] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\vcztvtb7dporlydql.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\vcZtVTb7DpoRLydqL.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\vcztvtb7dporlydql.xlsx.a")) returned 1 [0057.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", lpFilePart=0x0) returned 0x42 [0057.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0057.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_wkfoo.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.980] GetFileType (hFile=0x2e4) returned 0x1 [0057.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0057.981] GetFileType (hFile=0x2e4) returned 0x1 [0057.981] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xc1bd [0057.981] ReadFile (in: hFile=0x2e4, lpBuffer=0x33807f4, nNumberOfBytesToRead=0xc1bd, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33807f4*, lpNumberOfBytesRead=0x138e714*=0xc1bd, lpOverlapped=0x0) returned 1 [0057.981] CloseHandle (hObject=0x2e4) returned 1 [0057.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0057.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0057.998] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0057.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", lpFilePart=0x0) returned 0x42 [0057.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0057.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_wkfoo.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0057.999] GetFileType (hFile=0x2e4) returned 0x1 [0057.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0057.999] GetFileType (hFile=0x2e4) returned 0x1 [0057.999] WriteFile (in: hFile=0x2e4, lpBuffer=0x33f1b34*, nNumberOfBytesToWrite=0xc1c0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x33f1b34*, lpNumberOfBytesWritten=0x138e708*=0xc1c0, lpOverlapped=0x0) returned 1 [0058.001] CloseHandle (hObject=0x2e4) returned 1 [0058.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx", lpFilePart=0x0) returned 0x42 [0058.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx.a", lpFilePart=0x0) returned 0x44 [0058.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0058.002] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_wkfoo.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cd60b0, ftCreationTime.dwHighDateTime=0x1d5eadd, ftLastAccessTime.dwLowDateTime=0x3ff4cca0, ftLastAccessTime.dwHighDateTime=0x1d5f02d, ftLastWriteTime.dwLowDateTime=0xd3859d98, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc1c0)) returned 1 [0058.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0058.003] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_wkfoo.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_WkFoo.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_wkfoo.pptx.a")) returned 1 [0058.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0058.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd", lpFilePart=0x0) returned 0x44 [0058.003] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0058.003] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165e30, ftCreationTime.dwHighDateTime=0x1d5ebec, ftLastAccessTime.dwLowDateTime=0x66b31780, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0x66b31780, ftLastWriteTime.dwHighDateTime=0x1d5eab9, nFileSizeHigh=0x0, nFileSizeLow=0x1712b, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4lhot0.csv", cAlternateFileName="")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c67ed0, ftCreationTime.dwHighDateTime=0x1d5f035, ftLastAccessTime.dwLowDateTime=0x7c240b90, ftLastAccessTime.dwHighDateTime=0x1d5e773, ftLastWriteTime.dwLowDateTime=0x7c240b90, ftLastWriteTime.dwHighDateTime=0x1d5e773, nFileSizeHigh=0x0, nFileSizeLow=0x98aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="HAWdKfOXO2VPD8KDWRX.doc", cAlternateFileName="HAWDKF~1.DOC")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6eeec0, ftCreationTime.dwHighDateTime=0x1d5eefa, ftLastAccessTime.dwLowDateTime=0xd4cb2f20, ftLastAccessTime.dwHighDateTime=0x1d5ec42, ftLastWriteTime.dwLowDateTime=0xd4cb2f20, ftLastWriteTime.dwHighDateTime=0x1d5ec42, nFileSizeHigh=0x0, nFileSizeLow=0x5325, dwReserved0=0x0, dwReserved1=0x0, cFileName="HCeaJLiUqT_zEXlk.pptx", cAlternateFileName="HCEAJL~1.PPT")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedac8e60, ftCreationTime.dwHighDateTime=0x1d5e4b5, ftLastAccessTime.dwLowDateTime=0xdd43e270, ftLastAccessTime.dwHighDateTime=0x1d5ec9a, ftLastWriteTime.dwLowDateTime=0xdd43e270, ftLastWriteTime.dwHighDateTime=0x1d5ec9a, nFileSizeHigh=0x0, nFileSizeLow=0x11f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgxl5JsDa.ots", cAlternateFileName="HGXL5J~1.OTS")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15f0ae0, ftCreationTime.dwHighDateTime=0x1d5e691, ftLastAccessTime.dwLowDateTime=0x52bb7180, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x52bb7180, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x9acb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEMnD0m.pptx", cAlternateFileName="JEMND0~1.PPT")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8480c4b0, ftCreationTime.dwHighDateTime=0x1d5e7c6, ftLastAccessTime.dwLowDateTime=0x45ed5d0, ftLastAccessTime.dwHighDateTime=0x1d5e4c2, ftLastWriteTime.dwLowDateTime=0x45ed5d0, ftLastWriteTime.dwHighDateTime=0x1d5e4c2, nFileSizeHigh=0x0, nFileSizeLow=0x1196c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m9zQt.pdf", cAlternateFileName="")) returned 1 [0058.004] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.004] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0058.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0058.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0058.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0058.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd", lpFilePart=0x0) returned 0x44 [0058.005] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc38 [0058.005] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeac3a300, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x9a4e3530, ftLastAccessTime.dwHighDateTime=0x1d5e252, ftLastWriteTime.dwLowDateTime=0x9a4e3530, ftLastWriteTime.dwHighDateTime=0x1d5e252, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.005] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165e30, ftCreationTime.dwHighDateTime=0x1d5ebec, ftLastAccessTime.dwLowDateTime=0x66b31780, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0x66b31780, ftLastWriteTime.dwHighDateTime=0x1d5eab9, nFileSizeHigh=0x0, nFileSizeLow=0x1712b, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4lhot0.csv", cAlternateFileName="")) returned 1 [0058.005] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c67ed0, ftCreationTime.dwHighDateTime=0x1d5f035, ftLastAccessTime.dwLowDateTime=0x7c240b90, ftLastAccessTime.dwHighDateTime=0x1d5e773, ftLastWriteTime.dwLowDateTime=0x7c240b90, ftLastWriteTime.dwHighDateTime=0x1d5e773, nFileSizeHigh=0x0, nFileSizeLow=0x98aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="HAWdKfOXO2VPD8KDWRX.doc", cAlternateFileName="HAWDKF~1.DOC")) returned 1 [0058.005] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6eeec0, ftCreationTime.dwHighDateTime=0x1d5eefa, ftLastAccessTime.dwLowDateTime=0xd4cb2f20, ftLastAccessTime.dwHighDateTime=0x1d5ec42, ftLastWriteTime.dwLowDateTime=0xd4cb2f20, ftLastWriteTime.dwHighDateTime=0x1d5ec42, nFileSizeHigh=0x0, nFileSizeLow=0x5325, dwReserved0=0x0, dwReserved1=0x0, cFileName="HCeaJLiUqT_zEXlk.pptx", cAlternateFileName="HCEAJL~1.PPT")) returned 1 [0058.005] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedac8e60, ftCreationTime.dwHighDateTime=0x1d5e4b5, ftLastAccessTime.dwLowDateTime=0xdd43e270, ftLastAccessTime.dwHighDateTime=0x1d5ec9a, ftLastWriteTime.dwLowDateTime=0xdd43e270, ftLastWriteTime.dwHighDateTime=0x1d5ec9a, nFileSizeHigh=0x0, nFileSizeLow=0x11f02, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgxl5JsDa.ots", cAlternateFileName="HGXL5J~1.OTS")) returned 1 [0058.006] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15f0ae0, ftCreationTime.dwHighDateTime=0x1d5e691, ftLastAccessTime.dwLowDateTime=0x52bb7180, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x52bb7180, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x9acb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEMnD0m.pptx", cAlternateFileName="JEMND0~1.PPT")) returned 1 [0058.006] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8480c4b0, ftCreationTime.dwHighDateTime=0x1d5e7c6, ftLastAccessTime.dwLowDateTime=0x45ed5d0, ftLastAccessTime.dwHighDateTime=0x1d5e4c2, ftLastWriteTime.dwLowDateTime=0x45ed5d0, ftLastWriteTime.dwHighDateTime=0x1d5e4c2, nFileSizeHigh=0x0, nFileSizeLow=0x1196c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m9zQt.pdf", cAlternateFileName="")) returned 1 [0058.006] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8480c4b0, ftCreationTime.dwHighDateTime=0x1d5e7c6, ftLastAccessTime.dwLowDateTime=0x45ed5d0, ftLastAccessTime.dwHighDateTime=0x1d5e4c2, ftLastWriteTime.dwLowDateTime=0x45ed5d0, ftLastWriteTime.dwHighDateTime=0x1d5e4c2, nFileSizeHigh=0x0, nFileSizeLow=0x1196c, dwReserved0=0x0, dwReserved1=0x0, cFileName="m9zQt.pdf", cAlternateFileName="")) returned 0 [0058.006] FindClose (in: hFindFile=0x169dc38 | out: hFindFile=0x169dc38) returned 1 [0058.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0058.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0058.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", lpFilePart=0x0) returned 0x50 [0058.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.006] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\d4lhot0.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.006] GetFileType (hFile=0x2e4) returned 0x1 [0058.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.006] GetFileType (hFile=0x2e4) returned 0x1 [0058.007] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x1712b [0058.007] ReadFile (in: hFile=0x2e4, lpBuffer=0x450cec0, nNumberOfBytesToRead=0x1712b, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x450cec0*, lpNumberOfBytesRead=0x138e6a0*=0x1712b, lpOverlapped=0x0) returned 1 [0058.007] CloseHandle (hObject=0x2e4) returned 1 [0058.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.138] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", lpFilePart=0x0) returned 0x50 [0058.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\d4lhot0.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.140] GetFileType (hFile=0x2e4) returned 0x1 [0058.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.140] GetFileType (hFile=0x2e4) returned 0x1 [0058.140] WriteFile (in: hFile=0x2e4, lpBuffer=0x45aca98*, nNumberOfBytesToWrite=0x17130, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x45aca98*, lpNumberOfBytesWritten=0x138e694*=0x17130, lpOverlapped=0x0) returned 1 [0058.142] CloseHandle (hObject=0x2e4) returned 1 [0058.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv", lpFilePart=0x0) returned 0x50 [0058.145] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv.a", lpFilePart=0x0) returned 0x52 [0058.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\d4lhot0.csv"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1165e30, ftCreationTime.dwHighDateTime=0x1d5ebec, ftLastAccessTime.dwLowDateTime=0x66b31780, ftLastAccessTime.dwHighDateTime=0x1d5eab9, ftLastWriteTime.dwLowDateTime=0xd39b15ea, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x17130)) returned 1 [0058.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.145] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\d4lhot0.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\D4lhot0.csv.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\d4lhot0.csv.a")) returned 1 [0058.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", lpFilePart=0x0) returned 0x5c [0058.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hawdkfoxo2vpd8kdwrx.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.146] GetFileType (hFile=0x2e4) returned 0x1 [0058.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.146] GetFileType (hFile=0x2e4) returned 0x1 [0058.146] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x98aa [0058.146] ReadFile (in: hFile=0x2e4, lpBuffer=0x344def4, nNumberOfBytesToRead=0x98aa, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x344def4*, lpNumberOfBytesRead=0x138e6a0*=0x98aa, lpOverlapped=0x0) returned 1 [0058.147] CloseHandle (hObject=0x2e4) returned 1 [0058.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", lpFilePart=0x0) returned 0x5c [0058.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hawdkfoxo2vpd8kdwrx.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.251] GetFileType (hFile=0x2e4) returned 0x1 [0058.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.252] GetFileType (hFile=0x2e4) returned 0x1 [0058.252] WriteFile (in: hFile=0x2e4, lpBuffer=0x32d4c14*, nNumberOfBytesToWrite=0x98b0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x32d4c14*, lpNumberOfBytesWritten=0x138e694*=0x98b0, lpOverlapped=0x0) returned 1 [0058.253] CloseHandle (hObject=0x2e4) returned 1 [0058.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc", lpFilePart=0x0) returned 0x5c [0058.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc.a", lpFilePart=0x0) returned 0x5e [0058.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hawdkfoxo2vpd8kdwrx.doc"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c67ed0, ftCreationTime.dwHighDateTime=0x1d5f035, ftLastAccessTime.dwLowDateTime=0x7c240b90, ftLastAccessTime.dwHighDateTime=0x1d5e773, ftLastWriteTime.dwLowDateTime=0xd3abc672, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x98b0)) returned 1 [0058.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.255] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hawdkfoxo2vpd8kdwrx.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HAWdKfOXO2VPD8KDWRX.doc.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hawdkfoxo2vpd8kdwrx.doc.a")) returned 1 [0058.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", lpFilePart=0x0) returned 0x5a [0058.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hceajliuqt_zexlk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.256] GetFileType (hFile=0x2e4) returned 0x1 [0058.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.256] GetFileType (hFile=0x2e4) returned 0x1 [0058.256] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x5325 [0058.256] ReadFile (in: hFile=0x2e4, lpBuffer=0x32deaf8, nNumberOfBytesToRead=0x5325, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x32deaf8*, lpNumberOfBytesRead=0x138e6a0*=0x5325, lpOverlapped=0x0) returned 1 [0058.256] CloseHandle (hObject=0x2e4) returned 1 [0058.365] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.366] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.366] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", lpFilePart=0x0) returned 0x5a [0058.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hceajliuqt_zexlk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.367] GetFileType (hFile=0x2e4) returned 0x1 [0058.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.367] GetFileType (hFile=0x2e4) returned 0x1 [0058.367] WriteFile (in: hFile=0x2e4, lpBuffer=0x3345a30*, nNumberOfBytesToWrite=0x5330, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x3345a30*, lpNumberOfBytesWritten=0x138e694*=0x5330, lpOverlapped=0x0) returned 1 [0058.368] CloseHandle (hObject=0x2e4) returned 1 [0058.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx", lpFilePart=0x0) returned 0x5a [0058.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx.a", lpFilePart=0x0) returned 0x5c [0058.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.370] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hceajliuqt_zexlk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6eeec0, ftCreationTime.dwHighDateTime=0x1d5eefa, ftLastAccessTime.dwLowDateTime=0xd4cb2f20, ftLastAccessTime.dwHighDateTime=0x1d5ec42, ftLastWriteTime.dwLowDateTime=0xd3bc734c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5330)) returned 1 [0058.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.370] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hceajliuqt_zexlk.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\HCeaJLiUqT_zEXlk.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\hceajliuqt_zexlk.pptx.a")) returned 1 [0058.370] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", lpFilePart=0x0) returned 0x51 [0058.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\jemnd0m.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.371] GetFileType (hFile=0x2e4) returned 0x1 [0058.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.371] GetFileType (hFile=0x2e4) returned 0x1 [0058.371] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x9acb [0058.371] ReadFile (in: hFile=0x2e4, lpBuffer=0x334b374, nNumberOfBytesToRead=0x9acb, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x334b374*, lpNumberOfBytesRead=0x138e6a0*=0x9acb, lpOverlapped=0x0) returned 1 [0058.371] CloseHandle (hObject=0x2e4) returned 1 [0058.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", lpFilePart=0x0) returned 0x51 [0058.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.387] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\jemnd0m.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.388] GetFileType (hFile=0x2e4) returned 0x1 [0058.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.389] GetFileType (hFile=0x2e4) returned 0x1 [0058.389] WriteFile (in: hFile=0x2e4, lpBuffer=0x33c8770*, nNumberOfBytesToWrite=0x9ad0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x33c8770*, lpNumberOfBytesWritten=0x138e694*=0x9ad0, lpOverlapped=0x0) returned 1 [0058.390] CloseHandle (hObject=0x2e4) returned 1 [0058.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx", lpFilePart=0x0) returned 0x51 [0058.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx.a", lpFilePart=0x0) returned 0x53 [0058.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\jemnd0m.pptx"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb15f0ae0, ftCreationTime.dwHighDateTime=0x1d5e691, ftLastAccessTime.dwLowDateTime=0x52bb7180, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0xd3c13aa3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9ad0)) returned 1 [0058.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.392] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\jemnd0m.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\JEMnD0m.pptx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\jemnd0m.pptx.a")) returned 1 [0058.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", lpFilePart=0x0) returned 0x4e [0058.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\m9zqt.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.392] GetFileType (hFile=0x2e4) returned 0x1 [0058.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.392] GetFileType (hFile=0x2e4) returned 0x1 [0058.392] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x1196c [0058.392] ReadFile (in: hFile=0x2e4, lpBuffer=0x33d27d0, nNumberOfBytesToRead=0x1196c, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x33d27d0*, lpNumberOfBytesRead=0x138e6a0*=0x1196c, lpOverlapped=0x0) returned 1 [0058.393] CloseHandle (hObject=0x2e4) returned 1 [0058.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", lpFilePart=0x0) returned 0x4e [0058.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\m9zqt.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.475] GetFileType (hFile=0x2e4) returned 0x1 [0058.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.475] GetFileType (hFile=0x2e4) returned 0x1 [0058.475] WriteFile (in: hFile=0x2e4, lpBuffer=0x345421c*, nNumberOfBytesToWrite=0x11970, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x345421c*, lpNumberOfBytesWritten=0x138e694*=0x11970, lpOverlapped=0x0) returned 1 [0058.476] CloseHandle (hObject=0x2e4) returned 1 [0058.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf", lpFilePart=0x0) returned 0x4e [0058.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf.a", lpFilePart=0x0) returned 0x50 [0058.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.479] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\m9zqt.pdf"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8480c4b0, ftCreationTime.dwHighDateTime=0x1d5e7c6, ftLastAccessTime.dwLowDateTime=0x45ed5d0, ftLastAccessTime.dwHighDateTime=0x1d5e4c2, ftLastWriteTime.dwLowDateTime=0xd3cd2453, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11970)) returned 1 [0058.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.479] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\m9zqt.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\HqVun79_LztQd\\m9zQt.pdf.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\hqvun79_lztqd\\m9zqt.pdf.a")) returned 1 [0058.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0058.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc", lpFilePart=0x0) returned 0x4b [0058.480] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcb8 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6259d180, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0xb56aea10, ftLastAccessTime.dwHighDateTime=0x1d5eb0e, ftLastWriteTime.dwLowDateTime=0xb56aea10, ftLastWriteTime.dwHighDateTime=0x1d5eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x12d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="0V376oZ-zslxKi5jmf.odp", cAlternateFileName="0V376O~1.ODP")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec484d80, ftCreationTime.dwHighDateTime=0x1d5ead6, ftLastAccessTime.dwLowDateTime=0x5a7f3480, ftLastAccessTime.dwHighDateTime=0x1d5eaaf, ftLastWriteTime.dwLowDateTime=0x5a7f3480, ftLastWriteTime.dwHighDateTime=0x1d5eaaf, nFileSizeHigh=0x0, nFileSizeLow=0x119d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="e 4bpw4ZNWHs NfchA.odt", cAlternateFileName="E4BPW4~1.ODT")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf314a220, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x5069570, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0x5069570, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0xe9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gccJC4DK0Ej.odt", cAlternateFileName="GCCJC4~1.ODT")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d303710, ftCreationTime.dwHighDateTime=0x1d5f106, ftLastAccessTime.dwLowDateTime=0x3f45a000, ftLastAccessTime.dwHighDateTime=0x1d5f121, ftLastWriteTime.dwLowDateTime=0x3f45a000, ftLastWriteTime.dwHighDateTime=0x1d5f121, nFileSizeHigh=0x0, nFileSizeLow=0x8223, dwReserved0=0x0, dwReserved1=0x0, cFileName="jh07bY79kBHMz.xls", cAlternateFileName="JH07BY~1.XLS")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe536b70, ftCreationTime.dwHighDateTime=0x1d5e240, ftLastAccessTime.dwLowDateTime=0x6a8a4790, ftLastAccessTime.dwHighDateTime=0x1d5ea53, ftLastWriteTime.dwLowDateTime=0x6a8a4790, ftLastWriteTime.dwHighDateTime=0x1d5ea53, nFileSizeHigh=0x0, nFileSizeLow=0x1402a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUT-ggvc2G 2M.pps", cAlternateFileName="NUT-GG~1.PPS")) returned 1 [0058.480] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd25580, ftCreationTime.dwHighDateTime=0x1d5edc9, ftLastAccessTime.dwLowDateTime=0xbae8fb30, ftLastAccessTime.dwHighDateTime=0x1d5e91a, ftLastWriteTime.dwLowDateTime=0xbae8fb30, ftLastWriteTime.dwHighDateTime=0x1d5e91a, nFileSizeHigh=0x0, nFileSizeLow=0x5152, dwReserved0=0x0, dwReserved1=0x0, cFileName="uAOW fSI9L_2Fl_G4i.ots", cAlternateFileName="UAOWFS~1.OTS")) returned 1 [0058.481] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18275110, ftCreationTime.dwHighDateTime=0x1d5ea2f, ftLastAccessTime.dwLowDateTime=0xf01fe20, ftLastAccessTime.dwHighDateTime=0x1d5e726, ftLastWriteTime.dwLowDateTime=0xf01fe20, ftLastWriteTime.dwHighDateTime=0x1d5e726, nFileSizeHigh=0x0, nFileSizeLow=0x15c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="W6dKoAO9SYZ60.pps", cAlternateFileName="W6DKOA~1.PPS")) returned 1 [0058.481] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc77f50, ftCreationTime.dwHighDateTime=0x1d5e105, ftLastAccessTime.dwLowDateTime=0x34879a50, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0x34879a50, ftLastWriteTime.dwHighDateTime=0x1d5e9a7, nFileSizeHigh=0x0, nFileSizeLow=0x18a13, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbO01DF5ooTfiYa6FU.xlsx", cAlternateFileName="XBO01D~1.XLS")) returned 1 [0058.481] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3003c50, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0x626ab210, ftLastAccessTime.dwHighDateTime=0x1d5e88d, ftLastWriteTime.dwLowDateTime=0x626ab210, ftLastWriteTime.dwHighDateTime=0x1d5e88d, nFileSizeHigh=0x0, nFileSizeLow=0x156cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_toByOt_Ywp_KqCj.ods", cAlternateFileName="_TOBYO~1.ODS")) returned 1 [0058.481] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.481] FindClose (in: hFindFile=0x169dcb8 | out: hFindFile=0x169dcb8) returned 1 [0058.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0058.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0058.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0058.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc", lpFilePart=0x0) returned 0x4b [0058.481] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcb8 [0058.481] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x894adfd0, ftCreationTime.dwHighDateTime=0x1d5e2f8, ftLastAccessTime.dwLowDateTime=0x8a5d2bc0, ftLastAccessTime.dwHighDateTime=0x1d5e67d, ftLastWriteTime.dwLowDateTime=0x8a5d2bc0, ftLastWriteTime.dwHighDateTime=0x1d5e67d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.482] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6259d180, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0xb56aea10, ftLastAccessTime.dwHighDateTime=0x1d5eb0e, ftLastWriteTime.dwLowDateTime=0xb56aea10, ftLastWriteTime.dwHighDateTime=0x1d5eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x12d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="0V376oZ-zslxKi5jmf.odp", cAlternateFileName="0V376O~1.ODP")) returned 1 [0058.482] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec484d80, ftCreationTime.dwHighDateTime=0x1d5ead6, ftLastAccessTime.dwLowDateTime=0x5a7f3480, ftLastAccessTime.dwHighDateTime=0x1d5eaaf, ftLastWriteTime.dwLowDateTime=0x5a7f3480, ftLastWriteTime.dwHighDateTime=0x1d5eaaf, nFileSizeHigh=0x0, nFileSizeLow=0x119d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="e 4bpw4ZNWHs NfchA.odt", cAlternateFileName="E4BPW4~1.ODT")) returned 1 [0058.482] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf314a220, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x5069570, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0x5069570, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0xe9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gccJC4DK0Ej.odt", cAlternateFileName="GCCJC4~1.ODT")) returned 1 [0058.485] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d303710, ftCreationTime.dwHighDateTime=0x1d5f106, ftLastAccessTime.dwLowDateTime=0x3f45a000, ftLastAccessTime.dwHighDateTime=0x1d5f121, ftLastWriteTime.dwLowDateTime=0x3f45a000, ftLastWriteTime.dwHighDateTime=0x1d5f121, nFileSizeHigh=0x0, nFileSizeLow=0x8223, dwReserved0=0x0, dwReserved1=0x0, cFileName="jh07bY79kBHMz.xls", cAlternateFileName="JH07BY~1.XLS")) returned 1 [0058.485] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe536b70, ftCreationTime.dwHighDateTime=0x1d5e240, ftLastAccessTime.dwLowDateTime=0x6a8a4790, ftLastAccessTime.dwHighDateTime=0x1d5ea53, ftLastWriteTime.dwLowDateTime=0x6a8a4790, ftLastWriteTime.dwHighDateTime=0x1d5ea53, nFileSizeHigh=0x0, nFileSizeLow=0x1402a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUT-ggvc2G 2M.pps", cAlternateFileName="NUT-GG~1.PPS")) returned 1 [0058.486] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd25580, ftCreationTime.dwHighDateTime=0x1d5edc9, ftLastAccessTime.dwLowDateTime=0xbae8fb30, ftLastAccessTime.dwHighDateTime=0x1d5e91a, ftLastWriteTime.dwLowDateTime=0xbae8fb30, ftLastWriteTime.dwHighDateTime=0x1d5e91a, nFileSizeHigh=0x0, nFileSizeLow=0x5152, dwReserved0=0x0, dwReserved1=0x0, cFileName="uAOW fSI9L_2Fl_G4i.ots", cAlternateFileName="UAOWFS~1.OTS")) returned 1 [0058.486] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18275110, ftCreationTime.dwHighDateTime=0x1d5ea2f, ftLastAccessTime.dwLowDateTime=0xf01fe20, ftLastAccessTime.dwHighDateTime=0x1d5e726, ftLastWriteTime.dwLowDateTime=0xf01fe20, ftLastWriteTime.dwHighDateTime=0x1d5e726, nFileSizeHigh=0x0, nFileSizeLow=0x15c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="W6dKoAO9SYZ60.pps", cAlternateFileName="W6DKOA~1.PPS")) returned 1 [0058.486] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc77f50, ftCreationTime.dwHighDateTime=0x1d5e105, ftLastAccessTime.dwLowDateTime=0x34879a50, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0x34879a50, ftLastWriteTime.dwHighDateTime=0x1d5e9a7, nFileSizeHigh=0x0, nFileSizeLow=0x18a13, dwReserved0=0x0, dwReserved1=0x0, cFileName="xbO01DF5ooTfiYa6FU.xlsx", cAlternateFileName="XBO01D~1.XLS")) returned 1 [0058.486] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3003c50, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0x626ab210, ftLastAccessTime.dwHighDateTime=0x1d5e88d, ftLastWriteTime.dwLowDateTime=0x626ab210, ftLastWriteTime.dwHighDateTime=0x1d5e88d, nFileSizeHigh=0x0, nFileSizeLow=0x156cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_toByOt_Ywp_KqCj.ods", cAlternateFileName="_TOBYO~1.ODS")) returned 1 [0058.486] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3003c50, ftCreationTime.dwHighDateTime=0x1d5e1cb, ftLastAccessTime.dwLowDateTime=0x626ab210, ftLastAccessTime.dwHighDateTime=0x1d5e88d, ftLastWriteTime.dwLowDateTime=0x626ab210, ftLastWriteTime.dwHighDateTime=0x1d5e88d, nFileSizeHigh=0x0, nFileSizeLow=0x156cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="_toByOt_Ywp_KqCj.ods", cAlternateFileName="_TOBYO~1.ODS")) returned 0 [0058.486] FindClose (in: hFindFile=0x169dcb8 | out: hFindFile=0x169dcb8) returned 1 [0058.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0058.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0058.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", lpFilePart=0x0) returned 0x62 [0058.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\e 4bpw4znwhs nfcha.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.487] GetFileType (hFile=0x2e4) returned 0x1 [0058.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.487] GetFileType (hFile=0x2e4) returned 0x1 [0058.487] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x119d9 [0058.487] ReadFile (in: hFile=0x2e4, lpBuffer=0x3469c68, nNumberOfBytesToRead=0x119d9, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x3469c68*, lpNumberOfBytesRead=0x138e6a0*=0x119d9, lpOverlapped=0x0) returned 1 [0058.487] CloseHandle (hObject=0x2e4) returned 1 [0058.663] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", lpFilePart=0x0) returned 0x62 [0058.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\e 4bpw4znwhs nfcha.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.665] GetFileType (hFile=0x2e4) returned 0x1 [0058.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.665] GetFileType (hFile=0x2e4) returned 0x1 [0058.666] WriteFile (in: hFile=0x2e4, lpBuffer=0x32d44d8*, nNumberOfBytesToWrite=0x119e0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x32d44d8*, lpNumberOfBytesWritten=0x138e694*=0x119e0, lpOverlapped=0x0) returned 1 [0058.667] CloseHandle (hObject=0x2e4) returned 1 [0058.669] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt", lpFilePart=0x0) returned 0x62 [0058.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt.a", lpFilePart=0x0) returned 0x64 [0058.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\e 4bpw4znwhs nfcha.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec484d80, ftCreationTime.dwHighDateTime=0x1d5ead6, ftLastAccessTime.dwLowDateTime=0x5a7f3480, ftLastAccessTime.dwHighDateTime=0x1d5eaaf, ftLastWriteTime.dwLowDateTime=0xd3e9c2b0, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x119e0)) returned 1 [0058.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.670] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\e 4bpw4znwhs nfcha.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\e 4bpw4ZNWHs NfchA.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\e 4bpw4znwhs nfcha.odt.a")) returned 1 [0058.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", lpFilePart=0x0) returned 0x5b [0058.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\gccjc4dk0ej.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.671] GetFileType (hFile=0x2e4) returned 0x1 [0058.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.671] GetFileType (hFile=0x2e4) returned 0x1 [0058.671] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0xe9d2 [0058.671] ReadFile (in: hFile=0x2e4, lpBuffer=0x32e6510, nNumberOfBytesToRead=0xe9d2, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x32e6510*, lpNumberOfBytesRead=0x138e6a0*=0xe9d2, lpOverlapped=0x0) returned 1 [0058.672] CloseHandle (hObject=0x2e4) returned 1 [0058.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.688] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", lpFilePart=0x0) returned 0x5b [0058.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.688] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\gccjc4dk0ej.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.689] GetFileType (hFile=0x2e4) returned 0x1 [0058.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.689] GetFileType (hFile=0x2e4) returned 0x1 [0058.689] WriteFile (in: hFile=0x2e4, lpBuffer=0x335f20c*, nNumberOfBytesToWrite=0xe9e0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x335f20c*, lpNumberOfBytesWritten=0x138e694*=0xe9e0, lpOverlapped=0x0) returned 1 [0058.691] CloseHandle (hObject=0x2e4) returned 1 [0058.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt", lpFilePart=0x0) returned 0x5b [0058.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt.a", lpFilePart=0x0) returned 0x5d [0058.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\gccjc4dk0ej.odt"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf314a220, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x5069570, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xd3ee87b1, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe9e0)) returned 1 [0058.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.693] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\gccjc4dk0ej.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\gccJC4DK0Ej.odt.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\gccjc4dk0ej.odt.a")) returned 1 [0058.694] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", lpFilePart=0x0) returned 0x5d [0058.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\jh07by79kbhmz.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.694] GetFileType (hFile=0x2e4) returned 0x1 [0058.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.694] GetFileType (hFile=0x2e4) returned 0x1 [0058.694] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x8223 [0058.694] ReadFile (in: hFile=0x2e4, lpBuffer=0x336e1fc, nNumberOfBytesToRead=0x8223, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x336e1fc*, lpNumberOfBytesRead=0x138e6a0*=0x8223, lpOverlapped=0x0) returned 1 [0058.694] CloseHandle (hObject=0x2e4) returned 1 [0058.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", lpFilePart=0x0) returned 0x5d [0058.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\jh07by79kbhmz.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.775] GetFileType (hFile=0x2e4) returned 0x1 [0058.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.775] GetFileType (hFile=0x2e4) returned 0x1 [0058.775] WriteFile (in: hFile=0x2e4, lpBuffer=0x33e3ad8*, nNumberOfBytesToWrite=0x8230, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x33e3ad8*, lpNumberOfBytesWritten=0x138e694*=0x8230, lpOverlapped=0x0) returned 1 [0058.776] CloseHandle (hObject=0x2e4) returned 1 [0058.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls", lpFilePart=0x0) returned 0x5d [0058.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls.a", lpFilePart=0x0) returned 0x5f [0058.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\jh07by79kbhmz.xls"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d303710, ftCreationTime.dwHighDateTime=0x1d5f106, ftLastAccessTime.dwLowDateTime=0x3f45a000, ftLastAccessTime.dwHighDateTime=0x1d5f121, ftLastWriteTime.dwLowDateTime=0xd3fa7323, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8230)) returned 1 [0058.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.778] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\jh07by79kbhmz.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\jh07bY79kBHMz.xls.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\jh07by79kbhmz.xls.a")) returned 1 [0058.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", lpFilePart=0x0) returned 0x63 [0058.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0058.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\xbo01df5ootfiya6fu.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.779] GetFileType (hFile=0x2e4) returned 0x1 [0058.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0058.779] GetFileType (hFile=0x2e4) returned 0x1 [0058.779] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x18a13 [0058.780] ReadFile (in: hFile=0x2e4, lpBuffer=0x42dbd10, nNumberOfBytesToRead=0x18a13, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x42dbd10*, lpNumberOfBytesRead=0x138e6a0*=0x18a13, lpOverlapped=0x0) returned 1 [0058.782] CloseHandle (hObject=0x2e4) returned 1 [0058.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0058.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0058.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0058.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0058.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", lpFilePart=0x0) returned 0x63 [0058.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0058.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\xbo01df5ootfiya6fu.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.808] GetFileType (hFile=0x2e4) returned 0x1 [0058.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0058.808] GetFileType (hFile=0x2e4) returned 0x1 [0058.808] WriteFile (in: hFile=0x2e4, lpBuffer=0x4356fe0*, nNumberOfBytesToWrite=0x18a20, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x4356fe0*, lpNumberOfBytesWritten=0x138e694*=0x18a20, lpOverlapped=0x0) returned 1 [0058.810] CloseHandle (hObject=0x2e4) returned 1 [0058.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx", lpFilePart=0x0) returned 0x63 [0058.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx.a", lpFilePart=0x0) returned 0x65 [0058.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0058.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\xbo01df5ootfiya6fu.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc77f50, ftCreationTime.dwHighDateTime=0x1d5e105, ftLastAccessTime.dwLowDateTime=0x34879a50, ftLastAccessTime.dwHighDateTime=0x1d5e9a7, ftLastWriteTime.dwLowDateTime=0xd40b8752, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18a20)) returned 1 [0058.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0058.884] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\xbo01df5ootfiya6fu.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rj5-SiksS\\H_3XcyOgEOX8weMmYZ\\_BaF8C5_MTcPdIH1ZGwc\\xbO01DF5ooTfiYa6FU.xlsx.a" (normalized: "c:\\users\\fd1hvy\\documents\\rj5-sikss\\h_3xcyogeox8wemmyz\\_baf8c5_mtcpdih1zgwc\\xbo01df5ootfiya6fu.xlsx.a")) returned 1 [0058.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0058.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0058.884] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0058.885] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.885] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.885] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.885] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0058.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0058.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0058.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0058.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0058.885] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0058.885] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.886] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.886] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0058.886] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0058.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0058.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0058.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0058.886] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0058.886] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe524a6e3, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe524a6e3, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc78 [0058.886] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe524a6e3, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe524a6e3, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd18870, ftCreationTime.dwHighDateTime=0x1d5e732, ftLastAccessTime.dwLowDateTime=0x16a02410, ftLastAccessTime.dwHighDateTime=0x1d5e67a, ftLastWriteTime.dwLowDateTime=0x16a02410, ftLastWriteTime.dwHighDateTime=0x1d5e67a, nFileSizeHigh=0x0, nFileSizeLow=0xdcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ln2C0p.gif", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448574b0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xc07b3b30, ftLastAccessTime.dwHighDateTime=0x1d5f027, ftLastWriteTime.dwLowDateTime=0xc07b3b30, ftLastWriteTime.dwHighDateTime=0x1d5f027, nFileSizeHigh=0x0, nFileSizeLow=0x10c7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="42qe7vm.gif", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd70f90, ftCreationTime.dwHighDateTime=0x1d5e17c, ftLastAccessTime.dwLowDateTime=0xf70582e0, ftLastAccessTime.dwHighDateTime=0x1d5edfd, ftLastWriteTime.dwLowDateTime=0xf70582e0, ftLastWriteTime.dwHighDateTime=0x1d5edfd, nFileSizeHigh=0x0, nFileSizeLow=0x130a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="7HaCO4.bmp", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb66c9f0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x10833a20, ftLastAccessTime.dwHighDateTime=0x1d5e7da, ftLastWriteTime.dwLowDateTime=0x10833a20, ftLastWriteTime.dwHighDateTime=0x1d5e7da, nFileSizeHigh=0x0, nFileSizeLow=0x1322b, dwReserved0=0x0, dwReserved1=0x0, cFileName="9eTJ7_Gss_8gc2qS.gif", cAlternateFileName="9ETJ7_~1.GIF")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f956aa0, ftCreationTime.dwHighDateTime=0x1d5e339, ftLastAccessTime.dwLowDateTime=0xd6ea5b90, ftLastAccessTime.dwHighDateTime=0x1d5ed74, ftLastWriteTime.dwLowDateTime=0xd6ea5b90, ftLastWriteTime.dwHighDateTime=0x1d5ed74, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4Ia.gif", cAlternateFileName="")) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61348cf0, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0xa5e342c0, ftLastAccessTime.dwHighDateTime=0x1d5e462, ftLastWriteTime.dwLowDateTime=0xa5e342c0, ftLastWriteTime.dwHighDateTime=0x1d5e462, nFileSizeHigh=0x0, nFileSizeLow=0x9f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GHCge9sEIqZ0K.png", cAlternateFileName="GHCGE9~1.PNG")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed50cd60, ftCreationTime.dwHighDateTime=0x1d5e342, ftLastAccessTime.dwLowDateTime=0x138fc640, ftLastAccessTime.dwHighDateTime=0x1d5e44a, ftLastWriteTime.dwLowDateTime=0x138fc640, ftLastWriteTime.dwHighDateTime=0x1d5e44a, nFileSizeHigh=0x0, nFileSizeLow=0xec2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC3JNWuwUD4.bmp", cAlternateFileName="HC3JNW~1.BMP")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7019ff0, ftCreationTime.dwHighDateTime=0x1d5e8d4, ftLastAccessTime.dwLowDateTime=0x8b54fc30, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0x8b54fc30, ftLastWriteTime.dwHighDateTime=0x1d5e23e, nFileSizeHigh=0x0, nFileSizeLow=0x18567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Itg12K.jpg", cAlternateFileName="")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3516ec10, ftCreationTime.dwHighDateTime=0x1d5e393, ftLastAccessTime.dwLowDateTime=0x8bf0d0d0, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0x8bf0d0d0, ftLastWriteTime.dwHighDateTime=0x1d5f051, nFileSizeHigh=0x0, nFileSizeLow=0x5f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="OHEF3T8xYwC_eUXE_dMl.jpg", cAlternateFileName="OHEF3T~1.JPG")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfb6efc0, ftCreationTime.dwHighDateTime=0x1d5e598, ftLastAccessTime.dwLowDateTime=0x1cc59e00, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0x1cc59e00, ftLastWriteTime.dwHighDateTime=0x1d5eb03, nFileSizeHigh=0x0, nFileSizeLow=0x8396, dwReserved0=0x0, dwReserved1=0x0, cFileName="pxKpu7awsvNnryQ.gif", cAlternateFileName="PXKPU7~1.GIF")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tIziTy8oOGmMTGbF", cAlternateFileName="TIZITY~1")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ad6690, ftCreationTime.dwHighDateTime=0x1d5e7a8, ftLastAccessTime.dwLowDateTime=0xef602f20, ftLastAccessTime.dwHighDateTime=0x1d5e855, ftLastWriteTime.dwLowDateTime=0xef602f20, ftLastWriteTime.dwHighDateTime=0x1d5e855, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOIgjTe.jpg", cAlternateFileName="")) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2779b470, ftCreationTime.dwHighDateTime=0x1d5e64f, ftLastAccessTime.dwLowDateTime=0x19a7c490, ftLastAccessTime.dwHighDateTime=0x1d5efd7, ftLastWriteTime.dwLowDateTime=0x19a7c490, ftLastWriteTime.dwHighDateTime=0x1d5efd7, nFileSizeHigh=0x0, nFileSizeLow=0x1874d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xEKc8tzH1gI6wLl1yM.png", cAlternateFileName="XEKC8T~1.PNG")) returned 1 [0058.889] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451df2c0, ftCreationTime.dwHighDateTime=0x1d5e37f, ftLastAccessTime.dwLowDateTime=0x43770f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c9, ftLastWriteTime.dwLowDateTime=0x43770f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c9, nFileSizeHigh=0x0, nFileSizeLow=0x13244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ynFfhWLv ui86rXX.gif", cAlternateFileName="YNFFHW~1.GIF")) returned 1 [0058.889] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52644ce0, ftCreationTime.dwHighDateTime=0x1d5ecad, ftLastAccessTime.dwLowDateTime=0x84cb8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0x84cb8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x17e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="yRl.bmp", cAlternateFileName="")) returned 1 [0058.889] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc382420, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xc2eb5810, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0xc2eb5810, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x4b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z940ry9PLm6wG.bmp", cAlternateFileName="Z940RY~1.BMP")) returned 1 [0058.889] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83420520, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0xe802ffd0, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0xe802ffd0, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x1708d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zkv 5 HDcDPXOiUxxY.png", cAlternateFileName="ZKV5HD~1.PNG")) returned 1 [0058.889] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.889] FindClose (in: hFindFile=0x169dc78 | out: hFindFile=0x169dc78) returned 1 [0058.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0058.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0058.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0058.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0058.889] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe524a6e3, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe524a6e3, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe524a6e3, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe524a6e3, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd18870, ftCreationTime.dwHighDateTime=0x1d5e732, ftLastAccessTime.dwLowDateTime=0x16a02410, ftLastAccessTime.dwHighDateTime=0x1d5e67a, ftLastWriteTime.dwLowDateTime=0x16a02410, ftLastWriteTime.dwHighDateTime=0x1d5e67a, nFileSizeHigh=0x0, nFileSizeLow=0xdcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1ln2C0p.gif", cAlternateFileName="")) returned 1 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448574b0, ftCreationTime.dwHighDateTime=0x1d5e46e, ftLastAccessTime.dwLowDateTime=0xc07b3b30, ftLastAccessTime.dwHighDateTime=0x1d5f027, ftLastWriteTime.dwLowDateTime=0xc07b3b30, ftLastWriteTime.dwHighDateTime=0x1d5f027, nFileSizeHigh=0x0, nFileSizeLow=0x10c7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="42qe7vm.gif", cAlternateFileName="")) returned 1 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd70f90, ftCreationTime.dwHighDateTime=0x1d5e17c, ftLastAccessTime.dwLowDateTime=0xf70582e0, ftLastAccessTime.dwHighDateTime=0x1d5edfd, ftLastWriteTime.dwLowDateTime=0xf70582e0, ftLastWriteTime.dwHighDateTime=0x1d5edfd, nFileSizeHigh=0x0, nFileSizeLow=0x130a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="7HaCO4.bmp", cAlternateFileName="")) returned 1 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb66c9f0, ftCreationTime.dwHighDateTime=0x1d5e316, ftLastAccessTime.dwLowDateTime=0x10833a20, ftLastAccessTime.dwHighDateTime=0x1d5e7da, ftLastWriteTime.dwLowDateTime=0x10833a20, ftLastWriteTime.dwHighDateTime=0x1d5e7da, nFileSizeHigh=0x0, nFileSizeLow=0x1322b, dwReserved0=0x0, dwReserved1=0x0, cFileName="9eTJ7_Gss_8gc2qS.gif", cAlternateFileName="9ETJ7_~1.GIF")) returned 1 [0058.890] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f956aa0, ftCreationTime.dwHighDateTime=0x1d5e339, ftLastAccessTime.dwLowDateTime=0xd6ea5b90, ftLastAccessTime.dwHighDateTime=0x1d5ed74, ftLastWriteTime.dwLowDateTime=0xd6ea5b90, ftLastWriteTime.dwHighDateTime=0x1d5ed74, nFileSizeHigh=0x0, nFileSizeLow=0x8cb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="f4Ia.gif", cAlternateFileName="")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61348cf0, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0xa5e342c0, ftLastAccessTime.dwHighDateTime=0x1d5e462, ftLastWriteTime.dwLowDateTime=0xa5e342c0, ftLastWriteTime.dwHighDateTime=0x1d5e462, nFileSizeHigh=0x0, nFileSizeLow=0x9f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GHCge9sEIqZ0K.png", cAlternateFileName="GHCGE9~1.PNG")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed50cd60, ftCreationTime.dwHighDateTime=0x1d5e342, ftLastAccessTime.dwLowDateTime=0x138fc640, ftLastAccessTime.dwHighDateTime=0x1d5e44a, ftLastWriteTime.dwLowDateTime=0x138fc640, ftLastWriteTime.dwHighDateTime=0x1d5e44a, nFileSizeHigh=0x0, nFileSizeLow=0xec2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hC3JNWuwUD4.bmp", cAlternateFileName="HC3JNW~1.BMP")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7019ff0, ftCreationTime.dwHighDateTime=0x1d5e8d4, ftLastAccessTime.dwLowDateTime=0x8b54fc30, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0x8b54fc30, ftLastWriteTime.dwHighDateTime=0x1d5e23e, nFileSizeHigh=0x0, nFileSizeLow=0x18567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Itg12K.jpg", cAlternateFileName="")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3516ec10, ftCreationTime.dwHighDateTime=0x1d5e393, ftLastAccessTime.dwLowDateTime=0x8bf0d0d0, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0x8bf0d0d0, ftLastWriteTime.dwHighDateTime=0x1d5f051, nFileSizeHigh=0x0, nFileSizeLow=0x5f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="OHEF3T8xYwC_eUXE_dMl.jpg", cAlternateFileName="OHEF3T~1.JPG")) returned 1 [0058.891] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfb6efc0, ftCreationTime.dwHighDateTime=0x1d5e598, ftLastAccessTime.dwLowDateTime=0x1cc59e00, ftLastAccessTime.dwHighDateTime=0x1d5eb03, ftLastWriteTime.dwLowDateTime=0x1cc59e00, ftLastWriteTime.dwHighDateTime=0x1d5eb03, nFileSizeHigh=0x0, nFileSizeLow=0x8396, dwReserved0=0x0, dwReserved1=0x0, cFileName="pxKpu7awsvNnryQ.gif", cAlternateFileName="PXKPU7~1.GIF")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tIziTy8oOGmMTGbF", cAlternateFileName="TIZITY~1")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ad6690, ftCreationTime.dwHighDateTime=0x1d5e7a8, ftLastAccessTime.dwLowDateTime=0xef602f20, ftLastAccessTime.dwHighDateTime=0x1d5e855, ftLastWriteTime.dwLowDateTime=0xef602f20, ftLastWriteTime.dwHighDateTime=0x1d5e855, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOIgjTe.jpg", cAlternateFileName="")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2779b470, ftCreationTime.dwHighDateTime=0x1d5e64f, ftLastAccessTime.dwLowDateTime=0x19a7c490, ftLastAccessTime.dwHighDateTime=0x1d5efd7, ftLastWriteTime.dwLowDateTime=0x19a7c490, ftLastWriteTime.dwHighDateTime=0x1d5efd7, nFileSizeHigh=0x0, nFileSizeLow=0x1874d, dwReserved0=0x0, dwReserved1=0x0, cFileName="xEKc8tzH1gI6wLl1yM.png", cAlternateFileName="XEKC8T~1.PNG")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451df2c0, ftCreationTime.dwHighDateTime=0x1d5e37f, ftLastAccessTime.dwLowDateTime=0x43770f90, ftLastAccessTime.dwHighDateTime=0x1d5e1c9, ftLastWriteTime.dwLowDateTime=0x43770f90, ftLastWriteTime.dwHighDateTime=0x1d5e1c9, nFileSizeHigh=0x0, nFileSizeLow=0x13244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ynFfhWLv ui86rXX.gif", cAlternateFileName="YNFFHW~1.GIF")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52644ce0, ftCreationTime.dwHighDateTime=0x1d5ecad, ftLastAccessTime.dwLowDateTime=0x84cb8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0x84cb8ca0, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x17e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="yRl.bmp", cAlternateFileName="")) returned 1 [0058.892] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc382420, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xc2eb5810, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0xc2eb5810, ftLastWriteTime.dwHighDateTime=0x1d5e577, nFileSizeHigh=0x0, nFileSizeLow=0x4b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z940ry9PLm6wG.bmp", cAlternateFileName="Z940RY~1.BMP")) returned 1 [0058.893] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83420520, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0xe802ffd0, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0xe802ffd0, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x1708d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zkv 5 HDcDPXOiUxxY.png", cAlternateFileName="ZKV5HD~1.PNG")) returned 1 [0058.893] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83420520, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0xe802ffd0, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0xe802ffd0, ftLastWriteTime.dwHighDateTime=0x1d5ebe0, nFileSizeHigh=0x0, nFileSizeLow=0x1708d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zkv 5 HDcDPXOiUxxY.png", cAlternateFileName="ZKV5HD~1.PNG")) returned 0 [0058.893] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0058.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0058.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0058.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", lpFilePart=0x0) returned 0x23 [0058.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0058.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\7haco4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0058.893] GetFileType (hFile=0x2e4) returned 0x1 [0058.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0058.893] GetFileType (hFile=0x2e4) returned 0x1 [0058.893] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x130a4 [0058.893] ReadFile (in: hFile=0x2e4, lpBuffer=0x343e078, nNumberOfBytesToRead=0x130a4, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x343e078*, lpNumberOfBytesRead=0x138e7fc*=0x130a4, lpOverlapped=0x0) returned 1 [0058.894] CloseHandle (hObject=0x2e4) returned 1 [0059.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", lpFilePart=0x0) returned 0x23 [0059.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\7haco4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.019] GetFileType (hFile=0x2e4) returned 0x1 [0059.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.019] GetFileType (hFile=0x2e4) returned 0x1 [0059.019] WriteFile (in: hFile=0x2e4, lpBuffer=0x32d80f8*, nNumberOfBytesToWrite=0x130b0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32d80f8*, lpNumberOfBytesWritten=0x138e7f0*=0x130b0, lpOverlapped=0x0) returned 1 [0059.021] CloseHandle (hObject=0x2e4) returned 1 [0059.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp", lpFilePart=0x0) returned 0x23 [0059.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp.a", lpFilePart=0x0) returned 0x25 [0059.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\7haco4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd70f90, ftCreationTime.dwHighDateTime=0x1d5e17c, ftLastAccessTime.dwLowDateTime=0xf70582e0, ftLastAccessTime.dwHighDateTime=0x1d5edfd, ftLastWriteTime.dwLowDateTime=0xd428fd64, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x130b0)) returned 1 [0059.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.072] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\7haco4.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\7HaCO4.bmp.a" (normalized: "c:\\users\\fd1hvy\\pictures\\7haco4.bmp.a")) returned 1 [0059.073] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", lpFilePart=0x0) returned 0x2a [0059.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ghcge9seiqz0k.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.073] GetFileType (hFile=0x2e4) returned 0x1 [0059.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.073] GetFileType (hFile=0x2e4) returned 0x1 [0059.073] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x9f72 [0059.074] ReadFile (in: hFile=0x2e4, lpBuffer=0x32eb5d4, nNumberOfBytesToRead=0x9f72, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32eb5d4*, lpNumberOfBytesRead=0x138e7fc*=0x9f72, lpOverlapped=0x0) returned 1 [0059.074] CloseHandle (hObject=0x2e4) returned 1 [0059.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", lpFilePart=0x0) returned 0x2a [0059.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ghcge9seiqz0k.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.178] GetFileType (hFile=0x2e4) returned 0x1 [0059.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.178] GetFileType (hFile=0x2e4) returned 0x1 [0059.178] WriteFile (in: hFile=0x2e4, lpBuffer=0x336a29c*, nNumberOfBytesToWrite=0x9f80, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x336a29c*, lpNumberOfBytesWritten=0x138e7f0*=0x9f80, lpOverlapped=0x0) returned 1 [0059.180] CloseHandle (hObject=0x2e4) returned 1 [0059.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png", lpFilePart=0x0) returned 0x2a [0059.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png.a", lpFilePart=0x0) returned 0x2c [0059.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ghcge9seiqz0k.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61348cf0, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0xa5e342c0, ftLastAccessTime.dwHighDateTime=0x1d5e462, ftLastWriteTime.dwLowDateTime=0xd439b07e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9f80)) returned 1 [0059.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ghcge9seiqz0k.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\GHCge9sEIqZ0K.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\ghcge9seiqz0k.png.a")) returned 1 [0059.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", lpFilePart=0x0) returned 0x28 [0059.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hc3jnwuwud4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.182] GetFileType (hFile=0x2e4) returned 0x1 [0059.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.182] GetFileType (hFile=0x2e4) returned 0x1 [0059.182] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xec2b [0059.183] ReadFile (in: hFile=0x2e4, lpBuffer=0x3374644, nNumberOfBytesToRead=0xec2b, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3374644*, lpNumberOfBytesRead=0x138e7fc*=0xec2b, lpOverlapped=0x0) returned 1 [0059.183] CloseHandle (hObject=0x2e4) returned 1 [0059.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.201] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", lpFilePart=0x0) returned 0x28 [0059.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.201] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hc3jnwuwud4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.202] GetFileType (hFile=0x2e4) returned 0x1 [0059.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.203] GetFileType (hFile=0x2e4) returned 0x1 [0059.203] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ed8d4*, nNumberOfBytesToWrite=0xec30, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33ed8d4*, lpNumberOfBytesWritten=0x138e7f0*=0xec30, lpOverlapped=0x0) returned 1 [0059.204] CloseHandle (hObject=0x2e4) returned 1 [0059.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp", lpFilePart=0x0) returned 0x28 [0059.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp.a", lpFilePart=0x0) returned 0x2a [0059.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hc3jnwuwud4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed50cd60, ftCreationTime.dwHighDateTime=0x1d5e342, ftLastAccessTime.dwLowDateTime=0x138fc640, ftLastAccessTime.dwHighDateTime=0x1d5e44a, ftLastWriteTime.dwLowDateTime=0xd43c12e0, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xec30)) returned 1 [0059.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.206] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hc3jnwuwud4.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hC3JNWuwUD4.bmp.a" (normalized: "c:\\users\\fd1hvy\\pictures\\hc3jnwuwud4.bmp.a")) returned 1 [0059.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", lpFilePart=0x0) returned 0x23 [0059.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\itg12k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.207] GetFileType (hFile=0x2e4) returned 0x1 [0059.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.207] GetFileType (hFile=0x2e4) returned 0x1 [0059.207] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x18567 [0059.207] ReadFile (in: hFile=0x2e4, lpBuffer=0x43b33e0, nNumberOfBytesToRead=0x18567, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x43b33e0*, lpNumberOfBytesRead=0x138e7fc*=0x18567, lpOverlapped=0x0) returned 1 [0059.352] CloseHandle (hObject=0x2e4) returned 1 [0059.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", lpFilePart=0x0) returned 0x23 [0059.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\itg12k.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.432] GetFileType (hFile=0x2e4) returned 0x1 [0059.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.433] GetFileType (hFile=0x2e4) returned 0x1 [0059.433] WriteFile (in: hFile=0x2e4, lpBuffer=0x442cf48*, nNumberOfBytesToWrite=0x18570, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x442cf48*, lpNumberOfBytesWritten=0x138e7f0*=0x18570, lpOverlapped=0x0) returned 1 [0059.435] CloseHandle (hObject=0x2e4) returned 1 [0059.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg", lpFilePart=0x0) returned 0x23 [0059.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg.a", lpFilePart=0x0) returned 0x25 [0059.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\itg12k.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7019ff0, ftCreationTime.dwHighDateTime=0x1d5e8d4, ftLastAccessTime.dwLowDateTime=0x8b54fc30, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0xd45fd597, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18570)) returned 1 [0059.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.438] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\itg12k.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Itg12K.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\itg12k.jpg.a")) returned 1 [0059.438] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", lpFilePart=0x0) returned 0x31 [0059.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ohef3t8xywc_euxe_dml.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.439] GetFileType (hFile=0x2e4) returned 0x1 [0059.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.439] GetFileType (hFile=0x2e4) returned 0x1 [0059.439] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x5f94 [0059.439] ReadFile (in: hFile=0x2e4, lpBuffer=0x3449afc, nNumberOfBytesToRead=0x5f94, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3449afc*, lpNumberOfBytesRead=0x138e7fc*=0x5f94, lpOverlapped=0x0) returned 1 [0059.439] CloseHandle (hObject=0x2e4) returned 1 [0059.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", lpFilePart=0x0) returned 0x31 [0059.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ohef3t8xywc_euxe_dml.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.505] GetFileType (hFile=0x2e4) returned 0x1 [0059.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.505] GetFileType (hFile=0x2e4) returned 0x1 [0059.505] WriteFile (in: hFile=0x2e4, lpBuffer=0x32bc3b4*, nNumberOfBytesToWrite=0x5fa0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32bc3b4*, lpNumberOfBytesWritten=0x138e7f0*=0x5fa0, lpOverlapped=0x0) returned 1 [0059.506] CloseHandle (hObject=0x2e4) returned 1 [0059.507] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg", lpFilePart=0x0) returned 0x31 [0059.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg.a", lpFilePart=0x0) returned 0x33 [0059.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ohef3t8xywc_euxe_dml.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3516ec10, ftCreationTime.dwHighDateTime=0x1d5e393, ftLastAccessTime.dwLowDateTime=0x8bf0d0d0, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0xd46bc003, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5fa0)) returned 1 [0059.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.508] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ohef3t8xywc_euxe_dml.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OHEF3T8xYwC_eUXE_dMl.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\ohef3t8xywc_euxe_dml.jpg.a")) returned 1 [0059.508] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", lpFilePart=0x0) returned 0x24 [0059.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\voigjte.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.508] GetFileType (hFile=0x2e4) returned 0x1 [0059.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.508] GetFileType (hFile=0x2e4) returned 0x1 [0059.509] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x52a [0059.509] ReadFile (in: hFile=0x2e4, lpBuffer=0x32c2cfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32c2cfc*, lpNumberOfBytesRead=0x138e7fc*=0x52a, lpOverlapped=0x0) returned 1 [0059.509] CloseHandle (hObject=0x2e4) returned 1 [0059.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.615] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", lpFilePart=0x0) returned 0x24 [0059.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\voigjte.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.617] GetFileType (hFile=0x2e4) returned 0x1 [0059.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.617] GetFileType (hFile=0x2e4) returned 0x1 [0059.617] WriteFile (in: hFile=0x2e4, lpBuffer=0x3312814*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x3312814*, lpNumberOfBytesWritten=0x138e7c4*=0x530, lpOverlapped=0x0) returned 1 [0059.618] CloseHandle (hObject=0x2e4) returned 1 [0059.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg", lpFilePart=0x0) returned 0x24 [0059.619] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg.a", lpFilePart=0x0) returned 0x26 [0059.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\voigjte.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30ad6690, ftCreationTime.dwHighDateTime=0x1d5e7a8, ftLastAccessTime.dwLowDateTime=0xef602f20, ftLastAccessTime.dwHighDateTime=0x1d5e855, ftLastWriteTime.dwLowDateTime=0xd47c72dd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x530)) returned 1 [0059.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.619] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\voigjte.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\vOIgjTe.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\voigjte.jpg.a")) returned 1 [0059.708] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", lpFilePart=0x0) returned 0x2f [0059.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xekc8tzh1gi6wll1ym.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.708] GetFileType (hFile=0x2e4) returned 0x1 [0059.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.709] GetFileType (hFile=0x2e4) returned 0x1 [0059.709] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x1874d [0059.709] ReadFile (in: hFile=0x2e4, lpBuffer=0x44454d8, nNumberOfBytesToRead=0x1874d, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x44454d8*, lpNumberOfBytesRead=0x138e7fc*=0x1874d, lpOverlapped=0x0) returned 1 [0059.711] CloseHandle (hObject=0x2e4) returned 1 [0059.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", lpFilePart=0x0) returned 0x2f [0059.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xekc8tzh1gi6wll1ym.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.784] GetFileType (hFile=0x2e4) returned 0x1 [0059.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.784] GetFileType (hFile=0x2e4) returned 0x1 [0059.784] WriteFile (in: hFile=0x2e4, lpBuffer=0x44bf9a8*, nNumberOfBytesToWrite=0x18750, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x44bf9a8*, lpNumberOfBytesWritten=0x138e7f0*=0x18750, lpOverlapped=0x0) returned 1 [0059.786] CloseHandle (hObject=0x2e4) returned 1 [0059.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png", lpFilePart=0x0) returned 0x2f [0059.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png.a", lpFilePart=0x0) returned 0x31 [0059.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xekc8tzh1gi6wll1ym.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2779b470, ftCreationTime.dwHighDateTime=0x1d5e64f, ftLastAccessTime.dwLowDateTime=0x19a7c490, ftLastAccessTime.dwHighDateTime=0x1d5efd7, ftLastWriteTime.dwLowDateTime=0xd496a937, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18750)) returned 1 [0059.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.790] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xekc8tzh1gi6wll1ym.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xEKc8tzH1gI6wLl1yM.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\xekc8tzh1gi6wll1ym.png.a")) returned 1 [0059.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", lpFilePart=0x0) returned 0x20 [0059.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yrl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.790] GetFileType (hFile=0x2e4) returned 0x1 [0059.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.790] GetFileType (hFile=0x2e4) returned 0x1 [0059.790] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x17e70 [0059.791] ReadFile (in: hFile=0x2e4, lpBuffer=0x44d8118, nNumberOfBytesToRead=0x17e70, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x44d8118*, lpNumberOfBytesRead=0x138e7fc*=0x17e70, lpOverlapped=0x0) returned 1 [0059.792] CloseHandle (hObject=0x2e4) returned 1 [0059.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", lpFilePart=0x0) returned 0x20 [0059.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yrl.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.817] GetFileType (hFile=0x2e4) returned 0x1 [0059.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.818] GetFileType (hFile=0x2e4) returned 0x1 [0059.818] WriteFile (in: hFile=0x2e4, lpBuffer=0x454f9c8*, nNumberOfBytesToWrite=0x17e80, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x454f9c8*, lpNumberOfBytesWritten=0x138e7f0*=0x17e80, lpOverlapped=0x0) returned 1 [0059.867] CloseHandle (hObject=0x2e4) returned 1 [0059.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp", lpFilePart=0x0) returned 0x20 [0059.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp.a", lpFilePart=0x0) returned 0x22 [0059.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yrl.bmp"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52644ce0, ftCreationTime.dwHighDateTime=0x1d5ecad, ftLastAccessTime.dwLowDateTime=0x84cb8ca0, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0xd4a297da, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x17e80)) returned 1 [0059.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.870] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\yrl.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\yRl.bmp.a" (normalized: "c:\\users\\fd1hvy\\pictures\\yrl.bmp.a")) returned 1 [0059.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", lpFilePart=0x0) returned 0x2a [0059.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.872] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z940ry9plm6wg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.872] GetFileType (hFile=0x2e4) returned 0x1 [0059.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.872] GetFileType (hFile=0x2e4) returned 0x1 [0059.872] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x4b20 [0059.872] ReadFile (in: hFile=0x2e4, lpBuffer=0x33ade50, nNumberOfBytesToRead=0x4b20, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33ade50*, lpNumberOfBytesRead=0x138e7fc*=0x4b20, lpOverlapped=0x0) returned 1 [0059.872] CloseHandle (hObject=0x2e4) returned 1 [0059.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", lpFilePart=0x0) returned 0x2a [0059.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z940ry9plm6wg.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.888] GetFileType (hFile=0x2e4) returned 0x1 [0059.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.888] GetFileType (hFile=0x2e4) returned 0x1 [0059.888] WriteFile (in: hFile=0x2e4, lpBuffer=0x3412428*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3412428*, lpNumberOfBytesWritten=0x138e7f0*=0x4b30, lpOverlapped=0x0) returned 1 [0059.889] CloseHandle (hObject=0x2e4) returned 1 [0059.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp", lpFilePart=0x0) returned 0x2a [0059.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp.a", lpFilePart=0x0) returned 0x2c [0059.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z940ry9plm6wg.bmp"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc382420, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xc2eb5810, ftLastAccessTime.dwHighDateTime=0x1d5e577, ftLastWriteTime.dwLowDateTime=0xd4a4fa88, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x4b30)) returned 1 [0059.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.891] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\z940ry9plm6wg.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Z940ry9PLm6wG.bmp.a" (normalized: "c:\\users\\fd1hvy\\pictures\\z940ry9plm6wg.bmp.a")) returned 1 [0059.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", lpFilePart=0x0) returned 0x2f [0059.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0059.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zkv 5 hdcdpxoiuxxy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.891] GetFileType (hFile=0x2e4) returned 0x1 [0059.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0059.892] GetFileType (hFile=0x2e4) returned 0x1 [0059.892] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x1708d [0059.892] ReadFile (in: hFile=0x2e4, lpBuffer=0x4567868, nNumberOfBytesToRead=0x1708d, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x4567868*, lpNumberOfBytesRead=0x138e7fc*=0x1708d, lpOverlapped=0x0) returned 1 [0059.894] CloseHandle (hObject=0x2e4) returned 1 [0059.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0059.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0059.972] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0059.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0059.973] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", lpFilePart=0x0) returned 0x2f [0059.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0059.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zkv 5 hdcdpxoiuxxy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.974] GetFileType (hFile=0x2e4) returned 0x1 [0059.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0059.974] GetFileType (hFile=0x2e4) returned 0x1 [0059.974] WriteFile (in: hFile=0x2e4, lpBuffer=0x4271a48*, nNumberOfBytesToWrite=0x17090, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x4271a48*, lpNumberOfBytesWritten=0x138e7f0*=0x17090, lpOverlapped=0x0) returned 1 [0059.976] CloseHandle (hObject=0x2e4) returned 1 [0059.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png", lpFilePart=0x0) returned 0x2f [0059.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png.a", lpFilePart=0x0) returned 0x31 [0059.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0059.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zkv 5 hdcdpxoiuxxy.png"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83420520, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0xe802ffd0, ftLastAccessTime.dwHighDateTime=0x1d5ebe0, ftLastWriteTime.dwLowDateTime=0xd4b34840, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x17090)) returned 1 [0059.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0059.979] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png" (normalized: "c:\\users\\fd1hvy\\pictures\\zkv 5 hdcdpxoiuxxy.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Zkv 5 HDcDPXOiUxxY.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\zkv 5 hdcdpxoiuxxy.png.a")) returned 1 [0059.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0059.980] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0059.986] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.987] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.987] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.987] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0059.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.987] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0059.987] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0059.987] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.987] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.987] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0059.988] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0059.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0059.988] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0059.989] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.989] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.989] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.989] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0059.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0059.989] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d878 [0059.990] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.990] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.990] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0059.990] FindClose (in: hFindFile=0x169d878 | out: hFindFile=0x169d878) returned 1 [0059.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF", lpFilePart=0x0) returned 0x29 [0059.991] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0059.991] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.991] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77df23c0, ftCreationTime.dwHighDateTime=0x1d5e5a3, ftLastAccessTime.dwLowDateTime=0x607ec4c0, ftLastAccessTime.dwHighDateTime=0x1d5ed68, ftLastWriteTime.dwLowDateTime=0x607ec4c0, ftLastWriteTime.dwHighDateTime=0x1d5ed68, nFileSizeHigh=0x0, nFileSizeLow=0x13cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0oPi8 iuhAtaYlf ypF.png", cAlternateFileName="0OPI8I~1.PNG")) returned 1 [0059.991] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2df320, ftCreationTime.dwHighDateTime=0x1d5e0c3, ftLastAccessTime.dwLowDateTime=0x32c9db30, ftLastAccessTime.dwHighDateTime=0x1d5f0ee, ftLastWriteTime.dwLowDateTime=0x32c9db30, ftLastWriteTime.dwHighDateTime=0x1d5f0ee, nFileSizeHigh=0x0, nFileSizeLow=0xc138, dwReserved0=0x0, dwReserved1=0x0, cFileName="1VelYm4AdE2B.gif", cAlternateFileName="1VELYM~1.GIF")) returned 1 [0059.991] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a65850, ftCreationTime.dwHighDateTime=0x1d5e6b9, ftLastAccessTime.dwLowDateTime=0xfae44c30, ftLastAccessTime.dwHighDateTime=0x1d5e9f6, ftLastWriteTime.dwLowDateTime=0xfae44c30, ftLastWriteTime.dwHighDateTime=0x1d5e9f6, nFileSizeHigh=0x0, nFileSizeLow=0xa02, dwReserved0=0x0, dwReserved1=0x0, cFileName="3YwxgHS7wo.png", cAlternateFileName="3YWXGH~1.PNG")) returned 1 [0059.991] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3cc880, ftCreationTime.dwHighDateTime=0x1d5ed31, ftLastAccessTime.dwLowDateTime=0xf21eea80, ftLastAccessTime.dwHighDateTime=0x1d5e0c1, ftLastWriteTime.dwLowDateTime=0xf21eea80, ftLastWriteTime.dwHighDateTime=0x1d5e0c1, nFileSizeHigh=0x0, nFileSizeLow=0xef39, dwReserved0=0x0, dwReserved1=0x0, cFileName="9iaOT7qGh72qgWE.jpg", cAlternateFileName="9IAOT7~1.JPG")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44516a60, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0x5f5d4730, ftLastAccessTime.dwHighDateTime=0x1d5eb4f, ftLastWriteTime.dwLowDateTime=0x5f5d4730, ftLastWriteTime.dwHighDateTime=0x1d5eb4f, nFileSizeHigh=0x0, nFileSizeLow=0x7e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="AE5E.gif", cAlternateFileName="")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x637e8fe0, ftCreationTime.dwHighDateTime=0x1d5e889, ftLastAccessTime.dwLowDateTime=0x745c110, ftLastAccessTime.dwHighDateTime=0x1d5eac0, ftLastWriteTime.dwLowDateTime=0x745c110, ftLastWriteTime.dwHighDateTime=0x1d5eac0, nFileSizeHigh=0x0, nFileSizeLow=0x10034, dwReserved0=0x0, dwReserved1=0x0, cFileName="aM7xVIkF.gif", cAlternateFileName="")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa112fb30, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0x804199d0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0x804199d0, ftLastWriteTime.dwHighDateTime=0x1d5e715, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Im8OFHwAT_X7YEe8sogt.jpg", cAlternateFileName="IM8OFH~1.JPG")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdde5e220, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0x86a690f0, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0x86a690f0, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0x7fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mkpx10BDTjql.png", cAlternateFileName="MKPX10~1.PNG")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefaf1190, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x3e577a20, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x3e577a20, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x3371, dwReserved0=0x0, dwReserved1=0x0, cFileName="qFC6XqgfxGQdE62.bmp", cAlternateFileName="QFC6XQ~1.BMP")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265cf970, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0xa59cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5e88b, ftLastWriteTime.dwLowDateTime=0xa59cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5e88b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="qiJE_.png", cAlternateFileName="")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eabe90, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0x682153f0, ftLastAccessTime.dwHighDateTime=0x1d5e51b, ftLastWriteTime.dwLowDateTime=0x682153f0, ftLastWriteTime.dwHighDateTime=0x1d5e51b, nFileSizeHigh=0x0, nFileSizeLow=0x18c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRf6x6ay5SLik4ywwSoz.gif", cAlternateFileName="TRF6X6~1.GIF")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a7638e0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0x83cacb70, ftLastAccessTime.dwHighDateTime=0x1d5ed06, ftLastWriteTime.dwLowDateTime=0x83cacb70, ftLastWriteTime.dwHighDateTime=0x1d5ed06, nFileSizeHigh=0x0, nFileSizeLow=0x1594a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCt2uI.jpg", cAlternateFileName="")) returned 1 [0059.992] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ee9d30, ftCreationTime.dwHighDateTime=0x1d5e5a6, ftLastAccessTime.dwLowDateTime=0x35997540, ftLastAccessTime.dwHighDateTime=0x1d5ef96, ftLastWriteTime.dwLowDateTime=0x35997540, ftLastWriteTime.dwHighDateTime=0x1d5ef96, nFileSizeHigh=0x0, nFileSizeLow=0x16252, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUv6X3hQvEJpuJ3lR.jpg", cAlternateFileName="WUV6X3~1.JPG")) returned 1 [0059.993] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81a0a0, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x6dd65010, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0x6dd65010, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x143d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YNrl6yfl-HPXEIC6gM.jpg", cAlternateFileName="YNRL6Y~1.JPG")) returned 1 [0059.993] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159eb500, ftCreationTime.dwHighDateTime=0x1d5ee4e, ftLastAccessTime.dwLowDateTime=0x230a2550, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0x230a2550, ftLastWriteTime.dwHighDateTime=0x1d5e3de, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNjoEXp1.jpg", cAlternateFileName="")) returned 1 [0059.993] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90009c80, ftCreationTime.dwHighDateTime=0x1d5e829, ftLastAccessTime.dwLowDateTime=0xbbd064d0, ftLastAccessTime.dwHighDateTime=0x1d5ee87, ftLastWriteTime.dwLowDateTime=0xbbd064d0, ftLastWriteTime.dwHighDateTime=0x1d5ee87, nFileSizeHigh=0x0, nFileSizeLow=0xf58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxA7 W9FkkJiS9M.jpg", cAlternateFileName="ZXA7W9~1.JPG")) returned 1 [0059.993] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.993] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0059.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0059.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF", lpFilePart=0x0) returned 0x29 [0059.993] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dbf8 [0059.993] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800ad6f0, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0xec6b13e0, ftLastAccessTime.dwHighDateTime=0x1d5e97a, ftLastWriteTime.dwLowDateTime=0xec6b13e0, ftLastWriteTime.dwHighDateTime=0x1d5e97a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77df23c0, ftCreationTime.dwHighDateTime=0x1d5e5a3, ftLastAccessTime.dwLowDateTime=0x607ec4c0, ftLastAccessTime.dwHighDateTime=0x1d5ed68, ftLastWriteTime.dwLowDateTime=0x607ec4c0, ftLastWriteTime.dwHighDateTime=0x1d5ed68, nFileSizeHigh=0x0, nFileSizeLow=0x13cbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0oPi8 iuhAtaYlf ypF.png", cAlternateFileName="0OPI8I~1.PNG")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2df320, ftCreationTime.dwHighDateTime=0x1d5e0c3, ftLastAccessTime.dwLowDateTime=0x32c9db30, ftLastAccessTime.dwHighDateTime=0x1d5f0ee, ftLastWriteTime.dwLowDateTime=0x32c9db30, ftLastWriteTime.dwHighDateTime=0x1d5f0ee, nFileSizeHigh=0x0, nFileSizeLow=0xc138, dwReserved0=0x0, dwReserved1=0x0, cFileName="1VelYm4AdE2B.gif", cAlternateFileName="1VELYM~1.GIF")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a65850, ftCreationTime.dwHighDateTime=0x1d5e6b9, ftLastAccessTime.dwLowDateTime=0xfae44c30, ftLastAccessTime.dwHighDateTime=0x1d5e9f6, ftLastWriteTime.dwLowDateTime=0xfae44c30, ftLastWriteTime.dwHighDateTime=0x1d5e9f6, nFileSizeHigh=0x0, nFileSizeLow=0xa02, dwReserved0=0x0, dwReserved1=0x0, cFileName="3YwxgHS7wo.png", cAlternateFileName="3YWXGH~1.PNG")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3cc880, ftCreationTime.dwHighDateTime=0x1d5ed31, ftLastAccessTime.dwLowDateTime=0xf21eea80, ftLastAccessTime.dwHighDateTime=0x1d5e0c1, ftLastWriteTime.dwLowDateTime=0xf21eea80, ftLastWriteTime.dwHighDateTime=0x1d5e0c1, nFileSizeHigh=0x0, nFileSizeLow=0xef39, dwReserved0=0x0, dwReserved1=0x0, cFileName="9iaOT7qGh72qgWE.jpg", cAlternateFileName="9IAOT7~1.JPG")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44516a60, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0x5f5d4730, ftLastAccessTime.dwHighDateTime=0x1d5eb4f, ftLastWriteTime.dwLowDateTime=0x5f5d4730, ftLastWriteTime.dwHighDateTime=0x1d5eb4f, nFileSizeHigh=0x0, nFileSizeLow=0x7e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="AE5E.gif", cAlternateFileName="")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x637e8fe0, ftCreationTime.dwHighDateTime=0x1d5e889, ftLastAccessTime.dwLowDateTime=0x745c110, ftLastAccessTime.dwHighDateTime=0x1d5eac0, ftLastWriteTime.dwLowDateTime=0x745c110, ftLastWriteTime.dwHighDateTime=0x1d5eac0, nFileSizeHigh=0x0, nFileSizeLow=0x10034, dwReserved0=0x0, dwReserved1=0x0, cFileName="aM7xVIkF.gif", cAlternateFileName="")) returned 1 [0059.994] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa112fb30, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0x804199d0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0x804199d0, ftLastWriteTime.dwHighDateTime=0x1d5e715, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Im8OFHwAT_X7YEe8sogt.jpg", cAlternateFileName="IM8OFH~1.JPG")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdde5e220, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0x86a690f0, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0x86a690f0, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0x7fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="mkpx10BDTjql.png", cAlternateFileName="MKPX10~1.PNG")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefaf1190, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x3e577a20, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0x3e577a20, ftLastWriteTime.dwHighDateTime=0x1d5e0f4, nFileSizeHigh=0x0, nFileSizeLow=0x3371, dwReserved0=0x0, dwReserved1=0x0, cFileName="qFC6XqgfxGQdE62.bmp", cAlternateFileName="QFC6XQ~1.BMP")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265cf970, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0xa59cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5e88b, ftLastWriteTime.dwLowDateTime=0xa59cc2f0, ftLastWriteTime.dwHighDateTime=0x1d5e88b, nFileSizeHigh=0x0, nFileSizeLow=0x4cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="qiJE_.png", cAlternateFileName="")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8eabe90, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0x682153f0, ftLastAccessTime.dwHighDateTime=0x1d5e51b, ftLastWriteTime.dwLowDateTime=0x682153f0, ftLastWriteTime.dwHighDateTime=0x1d5e51b, nFileSizeHigh=0x0, nFileSizeLow=0x18c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRf6x6ay5SLik4ywwSoz.gif", cAlternateFileName="TRF6X6~1.GIF")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a7638e0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0x83cacb70, ftLastAccessTime.dwHighDateTime=0x1d5ed06, ftLastWriteTime.dwLowDateTime=0x83cacb70, ftLastWriteTime.dwHighDateTime=0x1d5ed06, nFileSizeHigh=0x0, nFileSizeLow=0x1594a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VCt2uI.jpg", cAlternateFileName="")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ee9d30, ftCreationTime.dwHighDateTime=0x1d5e5a6, ftLastAccessTime.dwLowDateTime=0x35997540, ftLastAccessTime.dwHighDateTime=0x1d5ef96, ftLastWriteTime.dwLowDateTime=0x35997540, ftLastWriteTime.dwHighDateTime=0x1d5ef96, nFileSizeHigh=0x0, nFileSizeLow=0x16252, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUv6X3hQvEJpuJ3lR.jpg", cAlternateFileName="WUV6X3~1.JPG")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81a0a0, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x6dd65010, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0x6dd65010, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x143d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YNrl6yfl-HPXEIC6gM.jpg", cAlternateFileName="YNRL6Y~1.JPG")) returned 1 [0059.995] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159eb500, ftCreationTime.dwHighDateTime=0x1d5ee4e, ftLastAccessTime.dwLowDateTime=0x230a2550, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0x230a2550, ftLastWriteTime.dwHighDateTime=0x1d5e3de, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNjoEXp1.jpg", cAlternateFileName="")) returned 1 [0059.996] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90009c80, ftCreationTime.dwHighDateTime=0x1d5e829, ftLastAccessTime.dwLowDateTime=0xbbd064d0, ftLastAccessTime.dwHighDateTime=0x1d5ee87, ftLastWriteTime.dwLowDateTime=0xbbd064d0, ftLastWriteTime.dwHighDateTime=0x1d5ee87, nFileSizeHigh=0x0, nFileSizeLow=0xf58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxA7 W9FkkJiS9M.jpg", cAlternateFileName="ZXA7W9~1.JPG")) returned 1 [0059.996] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90009c80, ftCreationTime.dwHighDateTime=0x1d5e829, ftLastAccessTime.dwLowDateTime=0xbbd064d0, ftLastAccessTime.dwHighDateTime=0x1d5ee87, ftLastWriteTime.dwLowDateTime=0xbbd064d0, ftLastWriteTime.dwHighDateTime=0x1d5ee87, nFileSizeHigh=0x0, nFileSizeLow=0xf58a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZxA7 W9FkkJiS9M.jpg", cAlternateFileName="ZXA7W9~1.JPG")) returned 0 [0059.996] FindClose (in: hFindFile=0x169dbf8 | out: hFindFile=0x169dbf8) returned 1 [0059.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0059.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0059.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", lpFilePart=0x0) returned 0x41 [0059.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0059.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\0opi8 iuhataylf ypf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0059.996] GetFileType (hFile=0x2e4) returned 0x1 [0059.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0059.996] GetFileType (hFile=0x2e4) returned 0x1 [0059.996] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x13cbd [0059.996] ReadFile (in: hFile=0x2e4, lpBuffer=0x3282dbc, nNumberOfBytesToRead=0x13cbd, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x3282dbc*, lpNumberOfBytesRead=0x138e788*=0x13cbd, lpOverlapped=0x0) returned 1 [0059.997] CloseHandle (hObject=0x2e4) returned 1 [0060.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", lpFilePart=0x0) returned 0x41 [0060.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.089] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\0opi8 iuhataylf ypf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.091] GetFileType (hFile=0x2e4) returned 0x1 [0060.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.091] GetFileType (hFile=0x2e4) returned 0x1 [0060.091] WriteFile (in: hFile=0x2e4, lpBuffer=0x330b358*, nNumberOfBytesToWrite=0x13cc0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x330b358*, lpNumberOfBytesWritten=0x138e77c*=0x13cc0, lpOverlapped=0x0) returned 1 [0060.092] CloseHandle (hObject=0x2e4) returned 1 [0060.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png", lpFilePart=0x0) returned 0x41 [0060.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png.a", lpFilePart=0x0) returned 0x43 [0060.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\0opi8 iuhataylf ypf.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77df23c0, ftCreationTime.dwHighDateTime=0x1d5e5a3, ftLastAccessTime.dwLowDateTime=0x607ec4c0, ftLastAccessTime.dwHighDateTime=0x1d5ed68, ftLastWriteTime.dwLowDateTime=0xd4c3fb44, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x13cc0)) returned 1 [0060.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.095] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\0opi8 iuhataylf ypf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\0oPi8 iuhAtaYlf ypF.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\0opi8 iuhataylf ypf.png.a")) returned 1 [0060.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", lpFilePart=0x0) returned 0x38 [0060.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\3ywxghs7wo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.096] GetFileType (hFile=0x2e4) returned 0x1 [0060.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.096] GetFileType (hFile=0x2e4) returned 0x1 [0060.096] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xa02 [0060.096] ReadFile (in: hFile=0x2e4, lpBuffer=0x331ff44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x331ff44*, lpNumberOfBytesRead=0x138e788*=0xa02, lpOverlapped=0x0) returned 1 [0060.096] CloseHandle (hObject=0x2e4) returned 1 [0060.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", lpFilePart=0x0) returned 0x38 [0060.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\3ywxghs7wo.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.166] GetFileType (hFile=0x2e4) returned 0x1 [0060.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.166] GetFileType (hFile=0x2e4) returned 0x1 [0060.167] WriteFile (in: hFile=0x2e4, lpBuffer=0x3371198*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x138e750, lpOverlapped=0x0 | out: lpBuffer=0x3371198*, lpNumberOfBytesWritten=0x138e750*=0xa10, lpOverlapped=0x0) returned 1 [0060.167] CloseHandle (hObject=0x2e4) returned 1 [0060.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png", lpFilePart=0x0) returned 0x38 [0060.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png.a", lpFilePart=0x0) returned 0x3a [0060.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.170] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\3ywxghs7wo.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a65850, ftCreationTime.dwHighDateTime=0x1d5e6b9, ftLastAccessTime.dwLowDateTime=0xfae44c30, ftLastAccessTime.dwHighDateTime=0x1d5e9f6, ftLastWriteTime.dwLowDateTime=0xd4d0e238, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa10)) returned 1 [0060.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.170] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\3ywxghs7wo.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\3YwxgHS7wo.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\3ywxghs7wo.png.a")) returned 1 [0060.170] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", lpFilePart=0x0) returned 0x3d [0060.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\9iaot7qgh72qgwe.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.171] GetFileType (hFile=0x2e4) returned 0x1 [0060.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.171] GetFileType (hFile=0x2e4) returned 0x1 [0060.171] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xef39 [0060.171] ReadFile (in: hFile=0x2e4, lpBuffer=0x337245c, nNumberOfBytesToRead=0xef39, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x337245c*, lpNumberOfBytesRead=0x138e788*=0xef39, lpOverlapped=0x0) returned 1 [0060.171] CloseHandle (hObject=0x2e4) returned 1 [0060.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.228] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", lpFilePart=0x0) returned 0x3d [0060.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.229] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\9iaot7qgh72qgwe.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.230] GetFileType (hFile=0x2e4) returned 0x1 [0060.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.230] GetFileType (hFile=0x2e4) returned 0x1 [0060.230] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ec01c*, nNumberOfBytesToWrite=0xef40, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33ec01c*, lpNumberOfBytesWritten=0x138e77c*=0xef40, lpOverlapped=0x0) returned 1 [0060.231] CloseHandle (hObject=0x2e4) returned 1 [0060.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg", lpFilePart=0x0) returned 0x3d [0060.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg.a", lpFilePart=0x0) returned 0x3f [0060.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\9iaot7qgh72qgwe.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3cc880, ftCreationTime.dwHighDateTime=0x1d5ed31, ftLastAccessTime.dwLowDateTime=0xf21eea80, ftLastAccessTime.dwHighDateTime=0x1d5e0c1, ftLastWriteTime.dwLowDateTime=0xd4d971d2, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xef40)) returned 1 [0060.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.233] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\9iaot7qgh72qgwe.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\9iaOT7qGh72qgWE.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\9iaot7qgh72qgwe.jpg.a")) returned 1 [0060.234] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", lpFilePart=0x0) returned 0x42 [0060.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.234] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\im8ofhwat_x7yee8sogt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.234] GetFileType (hFile=0x2e4) returned 0x1 [0060.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.234] GetFileType (hFile=0x2e4) returned 0x1 [0060.234] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xa3a [0060.234] ReadFile (in: hFile=0x2e4, lpBuffer=0x33fbed8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x33fbed8*, lpNumberOfBytesRead=0x138e788*=0xa3a, lpOverlapped=0x0) returned 1 [0060.234] CloseHandle (hObject=0x2e4) returned 1 [0060.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", lpFilePart=0x0) returned 0x42 [0060.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\im8ofhwat_x7yee8sogt.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.250] GetFileType (hFile=0x2e4) returned 0x1 [0060.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.250] GetFileType (hFile=0x2e4) returned 0x1 [0060.250] WriteFile (in: hFile=0x2e4, lpBuffer=0x344d23c*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x138e750, lpOverlapped=0x0 | out: lpBuffer=0x344d23c*, lpNumberOfBytesWritten=0x138e750*=0xa40, lpOverlapped=0x0) returned 1 [0060.251] CloseHandle (hObject=0x2e4) returned 1 [0060.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg", lpFilePart=0x0) returned 0x42 [0060.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg.a", lpFilePart=0x0) returned 0x44 [0060.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\im8ofhwat_x7yee8sogt.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa112fb30, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0x804199d0, ftLastAccessTime.dwHighDateTime=0x1d5e715, ftLastWriteTime.dwLowDateTime=0xd4dbd42e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa40)) returned 1 [0060.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\im8ofhwat_x7yee8sogt.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\Im8OFHwAT_X7YEe8sogt.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\im8ofhwat_x7yee8sogt.jpg.a")) returned 1 [0060.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", lpFilePart=0x0) returned 0x3a [0060.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\mkpx10bdtjql.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.253] GetFileType (hFile=0x2e4) returned 0x1 [0060.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.253] GetFileType (hFile=0x2e4) returned 0x1 [0060.253] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x7fe9 [0060.253] ReadFile (in: hFile=0x2e4, lpBuffer=0x344e534, nNumberOfBytesToRead=0x7fe9, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x344e534*, lpNumberOfBytesRead=0x138e788*=0x7fe9, lpOverlapped=0x0) returned 1 [0060.253] CloseHandle (hObject=0x2e4) returned 1 [0060.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", lpFilePart=0x0) returned 0x3a [0060.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\mkpx10bdtjql.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.346] GetFileType (hFile=0x2e4) returned 0x1 [0060.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.346] GetFileType (hFile=0x2e4) returned 0x1 [0060.346] WriteFile (in: hFile=0x2e4, lpBuffer=0x32cc2d0*, nNumberOfBytesToWrite=0x7ff0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x32cc2d0*, lpNumberOfBytesWritten=0x138e77c*=0x7ff0, lpOverlapped=0x0) returned 1 [0060.348] CloseHandle (hObject=0x2e4) returned 1 [0060.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png", lpFilePart=0x0) returned 0x3a [0060.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png.a", lpFilePart=0x0) returned 0x3c [0060.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\mkpx10bdtjql.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdde5e220, ftCreationTime.dwHighDateTime=0x1d5e6e4, ftLastAccessTime.dwLowDateTime=0x86a690f0, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0xd4eb0d7e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x7ff0)) returned 1 [0060.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.349] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\mkpx10bdtjql.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\mkpx10BDTjql.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\mkpx10bdtjql.png.a")) returned 1 [0060.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", lpFilePart=0x0) returned 0x3d [0060.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qfc6xqgfxgqde62.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.350] GetFileType (hFile=0x2e4) returned 0x1 [0060.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.350] GetFileType (hFile=0x2e4) returned 0x1 [0060.350] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x3371 [0060.350] ReadFile (in: hFile=0x2e4, lpBuffer=0x32d4798, nNumberOfBytesToRead=0x3371, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32d4798*, lpNumberOfBytesRead=0x138e788*=0x3371, lpOverlapped=0x0) returned 1 [0060.350] CloseHandle (hObject=0x2e4) returned 1 [0060.413] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", lpFilePart=0x0) returned 0x3d [0060.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qfc6xqgfxgqde62.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.415] GetFileType (hFile=0x2e4) returned 0x1 [0060.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.415] GetFileType (hFile=0x2e4) returned 0x1 [0060.415] WriteFile (in: hFile=0x2e4, lpBuffer=0x3331860*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x3331860*, lpNumberOfBytesWritten=0x138e77c*=0x3380, lpOverlapped=0x0) returned 1 [0060.416] CloseHandle (hObject=0x2e4) returned 1 [0060.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp", lpFilePart=0x0) returned 0x3d [0060.430] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp.a", lpFilePart=0x0) returned 0x3f [0060.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qfc6xqgfxgqde62.bmp"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefaf1190, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x3e577a20, ftLastAccessTime.dwHighDateTime=0x1d5e0f4, ftLastWriteTime.dwLowDateTime=0xd4f49b46, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x3380)) returned 1 [0060.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.431] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qfc6xqgfxgqde62.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qFC6XqgfxGQdE62.bmp.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qfc6xqgfxgqde62.bmp.a")) returned 1 [0060.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", lpFilePart=0x0) returned 0x33 [0060.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.432] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qije_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.432] GetFileType (hFile=0x2e4) returned 0x1 [0060.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.432] GetFileType (hFile=0x2e4) returned 0x1 [0060.432] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x4cc2 [0060.432] ReadFile (in: hFile=0x2e4, lpBuffer=0x33350a4, nNumberOfBytesToRead=0x4cc2, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x33350a4*, lpNumberOfBytesRead=0x138e788*=0x4cc2, lpOverlapped=0x0) returned 1 [0060.432] CloseHandle (hObject=0x2e4) returned 1 [0060.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", lpFilePart=0x0) returned 0x33 [0060.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qije_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.579] GetFileType (hFile=0x2e4) returned 0x1 [0060.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.579] GetFileType (hFile=0x2e4) returned 0x1 [0060.579] WriteFile (in: hFile=0x2e4, lpBuffer=0x3399ea0*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x3399ea0*, lpNumberOfBytesWritten=0x138e77c*=0x4cd0, lpOverlapped=0x0) returned 1 [0060.580] CloseHandle (hObject=0x2e4) returned 1 [0060.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png", lpFilePart=0x0) returned 0x33 [0060.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png.a", lpFilePart=0x0) returned 0x35 [0060.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qije_.png"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265cf970, ftCreationTime.dwHighDateTime=0x1d5ed58, ftLastAccessTime.dwLowDateTime=0xa59cc2f0, ftLastAccessTime.dwHighDateTime=0x1d5e88b, ftLastWriteTime.dwLowDateTime=0xd50ed558, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x4cd0)) returned 1 [0060.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.581] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qije_.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\qiJE_.png.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\qije_.png.a")) returned 1 [0060.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", lpFilePart=0x0) returned 0x34 [0060.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.582] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\vct2ui.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.582] GetFileType (hFile=0x2e4) returned 0x1 [0060.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.582] GetFileType (hFile=0x2e4) returned 0x1 [0060.582] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x1594a [0060.582] ReadFile (in: hFile=0x2e4, lpBuffer=0x457e918, nNumberOfBytesToRead=0x1594a, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x457e918*, lpNumberOfBytesRead=0x138e788*=0x1594a, lpOverlapped=0x0) returned 1 [0060.583] CloseHandle (hObject=0x2e4) returned 1 [0060.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", lpFilePart=0x0) returned 0x34 [0060.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\vct2ui.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.602] GetFileType (hFile=0x2e4) returned 0x1 [0060.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.602] GetFileType (hFile=0x2e4) returned 0x1 [0060.602] WriteFile (in: hFile=0x2e4, lpBuffer=0x43827d0*, nNumberOfBytesToWrite=0x15950, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x43827d0*, lpNumberOfBytesWritten=0x138e77c*=0x15950, lpOverlapped=0x0) returned 1 [0060.604] CloseHandle (hObject=0x2e4) returned 1 [0060.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg", lpFilePart=0x0) returned 0x34 [0060.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg.a", lpFilePart=0x0) returned 0x36 [0060.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\vct2ui.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a7638e0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0x83cacb70, ftLastAccessTime.dwHighDateTime=0x1d5ed06, ftLastWriteTime.dwLowDateTime=0xd513a4a3, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x15950)) returned 1 [0060.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.607] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\vct2ui.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\VCt2uI.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\vct2ui.jpg.a")) returned 1 [0060.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", lpFilePart=0x0) returned 0x3f [0060.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\wuv6x3hqvejpuj3lr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.607] GetFileType (hFile=0x2e4) returned 0x1 [0060.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.608] GetFileType (hFile=0x2e4) returned 0x1 [0060.608] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x16252 [0060.608] ReadFile (in: hFile=0x2e4, lpBuffer=0x4398140, nNumberOfBytesToRead=0x16252, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x4398140*, lpNumberOfBytesRead=0x138e788*=0x16252, lpOverlapped=0x0) returned 1 [0060.609] CloseHandle (hObject=0x2e4) returned 1 [0060.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", lpFilePart=0x0) returned 0x3f [0060.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.706] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\wuv6x3hqvejpuj3lr.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.708] GetFileType (hFile=0x2e4) returned 0x1 [0060.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.708] GetFileType (hFile=0x2e4) returned 0x1 [0060.708] WriteFile (in: hFile=0x2e4, lpBuffer=0x4406d50*, nNumberOfBytesToWrite=0x16260, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x4406d50*, lpNumberOfBytesWritten=0x138e77c*=0x16260, lpOverlapped=0x0) returned 1 [0060.710] CloseHandle (hObject=0x2e4) returned 1 [0060.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg", lpFilePart=0x0) returned 0x3f [0060.712] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg.a", lpFilePart=0x0) returned 0x41 [0060.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\wuv6x3hqvejpuj3lr.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1ee9d30, ftCreationTime.dwHighDateTime=0x1d5e5a6, ftLastAccessTime.dwLowDateTime=0x35997540, ftLastAccessTime.dwHighDateTime=0x1d5ef96, ftLastWriteTime.dwLowDateTime=0xd521e7ea, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x16260)) returned 1 [0060.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.712] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\wuv6x3hqvejpuj3lr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\WUv6X3hQvEJpuJ3lR.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\wuv6x3hqvejpuj3lr.jpg.a")) returned 1 [0060.713] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", lpFilePart=0x0) returned 0x40 [0060.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.713] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\ynrl6yfl-hpxeic6gm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.713] GetFileType (hFile=0x2e4) returned 0x1 [0060.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.713] GetFileType (hFile=0x2e4) returned 0x1 [0060.713] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x143d3 [0060.713] ReadFile (in: hFile=0x2e4, lpBuffer=0x3439594, nNumberOfBytesToRead=0x143d3, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x3439594*, lpNumberOfBytesRead=0x138e788*=0x143d3, lpOverlapped=0x0) returned 1 [0060.714] CloseHandle (hObject=0x2e4) returned 1 [0060.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", lpFilePart=0x0) returned 0x40 [0060.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\ynrl6yfl-hpxeic6gm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.735] GetFileType (hFile=0x2e4) returned 0x1 [0060.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.735] GetFileType (hFile=0x2e4) returned 0x1 [0060.735] WriteFile (in: hFile=0x2e4, lpBuffer=0x32e79c8*, nNumberOfBytesToWrite=0x143e0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x32e79c8*, lpNumberOfBytesWritten=0x138e77c*=0x143e0, lpOverlapped=0x0) returned 1 [0060.737] CloseHandle (hObject=0x2e4) returned 1 [0060.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg", lpFilePart=0x0) returned 0x40 [0060.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg.a", lpFilePart=0x0) returned 0x42 [0060.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\ynrl6yfl-hpxeic6gm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81a0a0, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x6dd65010, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0xd526acd2, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x143e0)) returned 1 [0060.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.740] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\ynrl6yfl-hpxeic6gm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\YNrl6yfl-HPXEIC6gM.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\ynrl6yfl-hpxeic6gm.jpg.a")) returned 1 [0060.740] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", lpFilePart=0x0) returned 0x36 [0060.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\znjoexp1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.740] GetFileType (hFile=0x2e4) returned 0x1 [0060.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.740] GetFileType (hFile=0x2e4) returned 0x1 [0060.740] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xa4a [0060.740] ReadFile (in: hFile=0x2e4, lpBuffer=0x32fccfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32fccfc*, lpNumberOfBytesRead=0x138e788*=0xa4a, lpOverlapped=0x0) returned 1 [0060.741] CloseHandle (hObject=0x2e4) returned 1 [0060.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.803] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", lpFilePart=0x0) returned 0x36 [0060.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\znjoexp1.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.804] GetFileType (hFile=0x2e4) returned 0x1 [0060.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.804] GetFileType (hFile=0x2e4) returned 0x1 [0060.804] WriteFile (in: hFile=0x2e4, lpBuffer=0x334e1dc*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x138e750, lpOverlapped=0x0 | out: lpBuffer=0x334e1dc*, lpNumberOfBytesWritten=0x138e750*=0xa50, lpOverlapped=0x0) returned 1 [0060.805] CloseHandle (hObject=0x2e4) returned 1 [0060.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg", lpFilePart=0x0) returned 0x36 [0060.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg.a", lpFilePart=0x0) returned 0x38 [0060.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\znjoexp1.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159eb500, ftCreationTime.dwHighDateTime=0x1d5ee4e, ftLastAccessTime.dwLowDateTime=0x230a2550, ftLastAccessTime.dwHighDateTime=0x1d5e3de, ftLastWriteTime.dwLowDateTime=0xd530363c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa50)) returned 1 [0060.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.806] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\znjoexp1.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\zNjoEXp1.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\znjoexp1.jpg.a")) returned 1 [0060.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", lpFilePart=0x0) returned 0x3d [0060.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0060.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\zxa7 w9fkkjis9m.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.807] GetFileType (hFile=0x2e4) returned 0x1 [0060.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0060.807] GetFileType (hFile=0x2e4) returned 0x1 [0060.807] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xf58a [0060.807] ReadFile (in: hFile=0x2e4, lpBuffer=0x334f494, nNumberOfBytesToRead=0xf58a, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x334f494*, lpNumberOfBytesRead=0x138e788*=0xf58a, lpOverlapped=0x0) returned 1 [0060.807] CloseHandle (hObject=0x2e4) returned 1 [0060.823] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.824] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", lpFilePart=0x0) returned 0x3d [0060.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0060.824] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\zxa7 w9fkkjis9m.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.825] GetFileType (hFile=0x2e4) returned 0x1 [0060.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0060.825] GetFileType (hFile=0x2e4) returned 0x1 [0060.825] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ca344*, nNumberOfBytesToWrite=0xf590, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33ca344*, lpNumberOfBytesWritten=0x138e77c*=0xf590, lpOverlapped=0x0) returned 1 [0060.827] CloseHandle (hObject=0x2e4) returned 1 [0060.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg", lpFilePart=0x0) returned 0x3d [0060.828] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg.a", lpFilePart=0x0) returned 0x3f [0060.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0060.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\zxa7 w9fkkjis9m.jpg"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90009c80, ftCreationTime.dwHighDateTime=0x1d5e829, ftLastAccessTime.dwLowDateTime=0xbbd064d0, ftLastAccessTime.dwHighDateTime=0x1d5ee87, ftLastWriteTime.dwLowDateTime=0xd534fb19, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf590)) returned 1 [0060.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0060.829] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\zxa7 w9fkkjis9m.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\tIziTy8oOGmMTGbF\\ZxA7 W9FkkJiS9M.jpg.a" (normalized: "c:\\users\\fd1hvy\\pictures\\tizity8oogmmtgbf\\zxa7 w9fkkjis9m.jpg.a")) returned 1 [0060.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0060.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0060.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4e9088e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4e9088e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4e9088e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4e9088e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6de780, ftCreationTime.dwHighDateTime=0x1d5ec67, ftLastAccessTime.dwLowDateTime=0xa7bdacb0, ftLastAccessTime.dwHighDateTime=0x1d5e3e1, ftLastWriteTime.dwLowDateTime=0xa7bdacb0, ftLastWriteTime.dwHighDateTime=0x1d5e3e1, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VGp.m4a", cAlternateFileName="")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Xz8A", cAlternateFileName="")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69749f0, ftCreationTime.dwHighDateTime=0x1d5e520, ftLastAccessTime.dwLowDateTime=0xa25bf2e0, ftLastAccessTime.dwHighDateTime=0x1d5ec88, ftLastWriteTime.dwLowDateTime=0xa25bf2e0, ftLastWriteTime.dwHighDateTime=0x1d5ec88, nFileSizeHigh=0x0, nFileSizeLow=0x17801, dwReserved0=0x0, dwReserved1=0x0, cFileName="DzocE7CZd.m4a", cAlternateFileName="DZOCE7~1.M4A")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06554d0, ftCreationTime.dwHighDateTime=0x1d5e5bd, ftLastAccessTime.dwLowDateTime=0x8b07f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e242, ftLastWriteTime.dwLowDateTime=0x8b07f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e242, nFileSizeHigh=0x0, nFileSizeLow=0x13ba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS-REc0bxhnXI8EbLsCT.wav", cAlternateFileName="LS-REC~1.WAV")) returned 1 [0060.830] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NY3gnwFowUC_DF_fGyRg", cAlternateFileName="NY3GNW~1")) returned 1 [0060.831] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfcf80, ftCreationTime.dwHighDateTime=0x1d5e137, ftLastAccessTime.dwLowDateTime=0x14878fe0, ftLastAccessTime.dwHighDateTime=0x1d5e55f, ftLastWriteTime.dwLowDateTime=0x14878fe0, ftLastWriteTime.dwHighDateTime=0x1d5e55f, nFileSizeHigh=0x0, nFileSizeLow=0xf303, dwReserved0=0x0, dwReserved1=0x0, cFileName="TxV-H.mp3", cAlternateFileName="")) returned 1 [0060.831] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaca3d70, ftCreationTime.dwHighDateTime=0x1d5f10e, ftLastAccessTime.dwLowDateTime=0xf3e8bf50, ftLastAccessTime.dwHighDateTime=0x1d5ead8, ftLastWriteTime.dwLowDateTime=0xf3e8bf50, ftLastWriteTime.dwHighDateTime=0x1d5ead8, nFileSizeHigh=0x0, nFileSizeLow=0x136f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-QYVd.m4a", cAlternateFileName="")) returned 1 [0060.831] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8438e720, ftCreationTime.dwHighDateTime=0x1d5e1f0, ftLastAccessTime.dwLowDateTime=0xfd591080, ftLastAccessTime.dwHighDateTime=0x1d5ed8a, ftLastWriteTime.dwLowDateTime=0xfd591080, ftLastWriteTime.dwHighDateTime=0x1d5ed8a, nFileSizeHigh=0x0, nFileSizeLow=0x5780, dwReserved0=0x0, dwReserved1=0x0, cFileName="_1y4c4_l8VCHzKqC.mp3", cAlternateFileName="_1Y4C4~1.MP3")) returned 1 [0060.831] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.831] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0060.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0060.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0060.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0060.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0060.831] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4e9088e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4e9088e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169ddb8 [0060.831] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe4e9088e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe4e9088e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6de780, ftCreationTime.dwHighDateTime=0x1d5ec67, ftLastAccessTime.dwLowDateTime=0xa7bdacb0, ftLastAccessTime.dwHighDateTime=0x1d5e3e1, ftLastWriteTime.dwLowDateTime=0xa7bdacb0, ftLastWriteTime.dwHighDateTime=0x1d5e3e1, nFileSizeHigh=0x0, nFileSizeLow=0x56f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="3VGp.m4a", cAlternateFileName="")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Xz8A", cAlternateFileName="")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69749f0, ftCreationTime.dwHighDateTime=0x1d5e520, ftLastAccessTime.dwLowDateTime=0xa25bf2e0, ftLastAccessTime.dwHighDateTime=0x1d5ec88, ftLastWriteTime.dwLowDateTime=0xa25bf2e0, ftLastWriteTime.dwHighDateTime=0x1d5ec88, nFileSizeHigh=0x0, nFileSizeLow=0x17801, dwReserved0=0x0, dwReserved1=0x0, cFileName="DzocE7CZd.m4a", cAlternateFileName="DZOCE7~1.M4A")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06554d0, ftCreationTime.dwHighDateTime=0x1d5e5bd, ftLastAccessTime.dwLowDateTime=0x8b07f0d0, ftLastAccessTime.dwHighDateTime=0x1d5e242, ftLastWriteTime.dwLowDateTime=0x8b07f0d0, ftLastWriteTime.dwHighDateTime=0x1d5e242, nFileSizeHigh=0x0, nFileSizeLow=0x13ba6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LS-REc0bxhnXI8EbLsCT.wav", cAlternateFileName="LS-REC~1.WAV")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NY3gnwFowUC_DF_fGyRg", cAlternateFileName="NY3GNW~1")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfcf80, ftCreationTime.dwHighDateTime=0x1d5e137, ftLastAccessTime.dwLowDateTime=0x14878fe0, ftLastAccessTime.dwHighDateTime=0x1d5e55f, ftLastWriteTime.dwLowDateTime=0x14878fe0, ftLastWriteTime.dwHighDateTime=0x1d5e55f, nFileSizeHigh=0x0, nFileSizeLow=0xf303, dwReserved0=0x0, dwReserved1=0x0, cFileName="TxV-H.mp3", cAlternateFileName="")) returned 1 [0060.832] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbaca3d70, ftCreationTime.dwHighDateTime=0x1d5f10e, ftLastAccessTime.dwLowDateTime=0xf3e8bf50, ftLastAccessTime.dwHighDateTime=0x1d5ead8, ftLastWriteTime.dwLowDateTime=0xf3e8bf50, ftLastWriteTime.dwHighDateTime=0x1d5ead8, nFileSizeHigh=0x0, nFileSizeLow=0x136f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="y-QYVd.m4a", cAlternateFileName="")) returned 1 [0060.833] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8438e720, ftCreationTime.dwHighDateTime=0x1d5e1f0, ftLastAccessTime.dwLowDateTime=0xfd591080, ftLastAccessTime.dwHighDateTime=0x1d5ed8a, ftLastWriteTime.dwLowDateTime=0xfd591080, ftLastWriteTime.dwHighDateTime=0x1d5ed8a, nFileSizeHigh=0x0, nFileSizeLow=0x5780, dwReserved0=0x0, dwReserved1=0x0, cFileName="_1y4c4_l8VCHzKqC.mp3", cAlternateFileName="_1Y4C4~1.MP3")) returned 1 [0060.833] FindNextFileW (in: hFindFile=0x169ddb8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8438e720, ftCreationTime.dwHighDateTime=0x1d5e1f0, ftLastAccessTime.dwLowDateTime=0xfd591080, ftLastAccessTime.dwHighDateTime=0x1d5ed8a, ftLastWriteTime.dwLowDateTime=0xfd591080, ftLastWriteTime.dwHighDateTime=0x1d5ed8a, nFileSizeHigh=0x0, nFileSizeLow=0x5780, dwReserved0=0x0, dwReserved1=0x0, cFileName="_1y4c4_l8VCHzKqC.mp3", cAlternateFileName="_1Y4C4~1.MP3")) returned 0 [0060.833] FindClose (in: hFindFile=0x169ddb8 | out: hFindFile=0x169ddb8) returned 1 [0060.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0060.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0060.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", lpFilePart=0x0) returned 0x1f [0060.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3" (normalized: "c:\\users\\fd1hvy\\music\\txv-h.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.833] GetFileType (hFile=0x2e4) returned 0x1 [0060.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.833] GetFileType (hFile=0x2e4) returned 0x1 [0060.833] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xf303 [0060.833] ReadFile (in: hFile=0x2e4, lpBuffer=0x33dbc08, nNumberOfBytesToRead=0xf303, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33dbc08*, lpNumberOfBytesRead=0x138e7fc*=0xf303, lpOverlapped=0x0) returned 1 [0060.834] CloseHandle (hObject=0x2e4) returned 1 [0060.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0060.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0060.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", lpFilePart=0x0) returned 0x1f [0060.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0060.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3" (normalized: "c:\\users\\fd1hvy\\music\\txv-h.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.929] GetFileType (hFile=0x2e4) returned 0x1 [0060.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0060.929] GetFileType (hFile=0x2e4) returned 0x1 [0060.929] WriteFile (in: hFile=0x2e4, lpBuffer=0x3456338*, nNumberOfBytesToWrite=0xf310, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x3456338*, lpNumberOfBytesWritten=0x138e7f0*=0xf310, lpOverlapped=0x0) returned 1 [0060.931] CloseHandle (hObject=0x2e4) returned 1 [0060.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3", lpFilePart=0x0) returned 0x1f [0060.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3.a", lpFilePart=0x0) returned 0x21 [0060.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0060.933] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3" (normalized: "c:\\users\\fd1hvy\\music\\txv-h.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddfcf80, ftCreationTime.dwHighDateTime=0x1d5e137, ftLastAccessTime.dwLowDateTime=0x14878fe0, ftLastAccessTime.dwHighDateTime=0x1d5e55f, ftLastWriteTime.dwLowDateTime=0xd5434c36, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf310)) returned 1 [0060.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0060.933] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3" (normalized: "c:\\users\\fd1hvy\\music\\txv-h.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\TxV-H.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\txv-h.mp3.a")) returned 1 [0060.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", lpFilePart=0x0) returned 0x2a [0060.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0060.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_1y4c4_l8vchzkqc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0060.982] GetFileType (hFile=0x2e4) returned 0x1 [0060.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0060.982] GetFileType (hFile=0x2e4) returned 0x1 [0060.982] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x5780 [0060.982] ReadFile (in: hFile=0x2e4, lpBuffer=0x3465a28, nNumberOfBytesToRead=0x5780, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x3465a28*, lpNumberOfBytesRead=0x138e7fc*=0x5780, lpOverlapped=0x0) returned 1 [0060.982] CloseHandle (hObject=0x2e4) returned 1 [0060.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0060.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0060.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0060.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0060.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", lpFilePart=0x0) returned 0x2a [0060.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0060.999] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_1y4c4_l8vchzkqc.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.000] GetFileType (hFile=0x2e4) returned 0x1 [0061.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0061.000] GetFileType (hFile=0x2e4) returned 0x1 [0061.000] WriteFile (in: hFile=0x2e4, lpBuffer=0x34cdde0*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x34cdde0*, lpNumberOfBytesWritten=0x138e7f0*=0x5790, lpOverlapped=0x0) returned 1 [0061.001] CloseHandle (hObject=0x2e4) returned 1 [0061.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3", lpFilePart=0x0) returned 0x2a [0061.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3.a", lpFilePart=0x0) returned 0x2c [0061.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0061.003] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_1y4c4_l8vchzkqc.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8438e720, ftCreationTime.dwHighDateTime=0x1d5e1f0, ftLastAccessTime.dwLowDateTime=0xfd591080, ftLastAccessTime.dwHighDateTime=0x1d5ed8a, ftLastWriteTime.dwLowDateTime=0xd54f34fe, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5790)) returned 1 [0061.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0061.003] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3" (normalized: "c:\\users\\fd1hvy\\music\\_1y4c4_l8vchzkqc.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\_1y4c4_l8VCHzKqC.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\_1y4c4_l8vchzkqc.mp3.a")) returned 1 [0061.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.003] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A", lpFilePart=0x0) returned 0x1b [0061.004] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad03a360, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x753b9520, ftLastAccessTime.dwHighDateTime=0x1d5ea50, ftLastWriteTime.dwLowDateTime=0x753b9520, ftLastWriteTime.dwHighDateTime=0x1d5ea50, nFileSizeHigh=0x0, nFileSizeLow=0x2ee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwRVX3Jt6l7-6fbjB4.mp3", cAlternateFileName="NWRVX3~1.MP3")) returned 1 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OhrFw4wOk-ruuQrf3jS4", cAlternateFileName="OHRFW4~1")) returned 1 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb2be8e0, ftCreationTime.dwHighDateTime=0x1d5ebdf, ftLastAccessTime.dwLowDateTime=0xdbaa2000, ftLastAccessTime.dwHighDateTime=0x1d5e8b2, ftLastWriteTime.dwLowDateTime=0xdbaa2000, ftLastWriteTime.dwHighDateTime=0x1d5e8b2, nFileSizeHigh=0x0, nFileSizeLow=0x147ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnnddxhR0XGp7F3Gh.wav", cAlternateFileName="PNNDDX~1.WAV")) returned 1 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qSbN7sk", cAlternateFileName="")) returned 1 [0061.004] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uI9AcgegV4QGJeFzPa", cAlternateFileName="UI9ACG~1")) returned 1 [0061.005] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc1970, ftCreationTime.dwHighDateTime=0x1d5e775, ftLastAccessTime.dwLowDateTime=0xabbea7b0, ftLastAccessTime.dwHighDateTime=0x1d5ead5, ftLastWriteTime.dwLowDateTime=0xabbea7b0, ftLastWriteTime.dwHighDateTime=0x1d5ead5, nFileSizeHigh=0x0, nFileSizeLow=0x159c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTh46UGy.m4a", cAlternateFileName="")) returned 1 [0061.005] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.005] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0061.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A", lpFilePart=0x0) returned 0x1b [0061.005] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0061.005] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18b01da0, ftCreationTime.dwHighDateTime=0x1d5f115, ftLastAccessTime.dwLowDateTime=0xf887a080, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xf887a080, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.005] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad03a360, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x753b9520, ftLastAccessTime.dwHighDateTime=0x1d5ea50, ftLastWriteTime.dwLowDateTime=0x753b9520, ftLastWriteTime.dwHighDateTime=0x1d5ea50, nFileSizeHigh=0x0, nFileSizeLow=0x2ee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="nwRVX3Jt6l7-6fbjB4.mp3", cAlternateFileName="NWRVX3~1.MP3")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OhrFw4wOk-ruuQrf3jS4", cAlternateFileName="OHRFW4~1")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb2be8e0, ftCreationTime.dwHighDateTime=0x1d5ebdf, ftLastAccessTime.dwLowDateTime=0xdbaa2000, ftLastAccessTime.dwHighDateTime=0x1d5e8b2, ftLastWriteTime.dwLowDateTime=0xdbaa2000, ftLastWriteTime.dwHighDateTime=0x1d5e8b2, nFileSizeHigh=0x0, nFileSizeLow=0x147ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnnddxhR0XGp7F3Gh.wav", cAlternateFileName="PNNDDX~1.WAV")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qSbN7sk", cAlternateFileName="")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uI9AcgegV4QGJeFzPa", cAlternateFileName="UI9ACG~1")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc1970, ftCreationTime.dwHighDateTime=0x1d5e775, ftLastAccessTime.dwLowDateTime=0xabbea7b0, ftLastAccessTime.dwHighDateTime=0x1d5ead5, ftLastWriteTime.dwLowDateTime=0xabbea7b0, ftLastWriteTime.dwHighDateTime=0x1d5ead5, nFileSizeHigh=0x0, nFileSizeLow=0x159c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTh46UGy.m4a", cAlternateFileName="")) returned 1 [0061.006] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc1970, ftCreationTime.dwHighDateTime=0x1d5e775, ftLastAccessTime.dwLowDateTime=0xabbea7b0, ftLastAccessTime.dwHighDateTime=0x1d5ead5, ftLastWriteTime.dwLowDateTime=0xabbea7b0, ftLastWriteTime.dwHighDateTime=0x1d5ead5, nFileSizeHigh=0x0, nFileSizeLow=0x159c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTh46UGy.m4a", cAlternateFileName="")) returned 0 [0061.006] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0061.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.007] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", lpFilePart=0x0) returned 0x32 [0061.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.007] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\nwrvx3jt6l7-6fbjb4.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.007] GetFileType (hFile=0x2e4) returned 0x1 [0061.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.007] GetFileType (hFile=0x2e4) returned 0x1 [0061.007] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x2ee9 [0061.007] ReadFile (in: hFile=0x2e4, lpBuffer=0x34d5470, nNumberOfBytesToRead=0x2ee9, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x34d5470*, lpNumberOfBytesRead=0x138e788*=0x2ee9, lpOverlapped=0x0) returned 1 [0061.007] CloseHandle (hObject=0x2e4) returned 1 [0061.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0061.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0061.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", lpFilePart=0x0) returned 0x32 [0061.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0061.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\nwrvx3jt6l7-6fbjb4.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.023] GetFileType (hFile=0x2e4) returned 0x1 [0061.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0061.023] GetFileType (hFile=0x2e4) returned 0x1 [0061.023] WriteFile (in: hFile=0x2e4, lpBuffer=0x3530d0c*, nNumberOfBytesToWrite=0x2ef0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x3530d0c*, lpNumberOfBytesWritten=0x138e77c*=0x2ef0, lpOverlapped=0x0) returned 1 [0061.024] CloseHandle (hObject=0x2e4) returned 1 [0061.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3", lpFilePart=0x0) returned 0x32 [0061.025] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3.a", lpFilePart=0x0) returned 0x34 [0061.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0061.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\nwrvx3jt6l7-6fbjb4.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad03a360, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x753b9520, ftLastAccessTime.dwHighDateTime=0x1d5ea50, ftLastWriteTime.dwLowDateTime=0xd551979a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0)) returned 1 [0061.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0061.025] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\nwrvx3jt6l7-6fbjb4.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\nwRVX3Jt6l7-6fbjB4.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\nwrvx3jt6l7-6fbjb4.mp3.a")) returned 1 [0061.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4", lpFilePart=0x0) returned 0x30 [0061.026] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d938 [0061.026] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.026] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585be20, ftCreationTime.dwHighDateTime=0x1d5eb5b, ftLastAccessTime.dwLowDateTime=0xd7448020, ftLastAccessTime.dwHighDateTime=0x1d5effe, ftLastWriteTime.dwLowDateTime=0xd7448020, ftLastWriteTime.dwHighDateTime=0x1d5effe, nFileSizeHigh=0x0, nFileSizeLow=0xe596, dwReserved0=0x0, dwReserved1=0x0, cFileName="4GYCYXn0.m4a", cAlternateFileName="")) returned 1 [0061.026] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="acoLoVSSCXH86sfEAk", cAlternateFileName="ACOLOV~1")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd734c770, ftCreationTime.dwHighDateTime=0x1d5f0a8, ftLastAccessTime.dwLowDateTime=0x16707350, ftLastAccessTime.dwHighDateTime=0x1d5e0ad, ftLastWriteTime.dwLowDateTime=0x16707350, ftLastWriteTime.dwHighDateTime=0x1d5e0ad, nFileSizeHigh=0x0, nFileSizeLow=0x8086, dwReserved0=0x0, dwReserved1=0x0, cFileName="HcigmjWHTy.wav", cAlternateFileName="HCIGMJ~1.WAV")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88a88a0, ftCreationTime.dwHighDateTime=0x1d5e22b, ftLastAccessTime.dwLowDateTime=0x44ca1690, ftLastAccessTime.dwHighDateTime=0x1d5e7d6, ftLastWriteTime.dwLowDateTime=0x44ca1690, ftLastWriteTime.dwHighDateTime=0x1d5e7d6, nFileSizeHigh=0x0, nFileSizeLow=0xa72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lNk2M RoL.mp3", cAlternateFileName="LNK2MR~1.MP3")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a1332d0, ftCreationTime.dwHighDateTime=0x1d5ea8e, ftLastAccessTime.dwLowDateTime=0x79bdf3b0, ftLastAccessTime.dwHighDateTime=0x1d5ece7, ftLastWriteTime.dwLowDateTime=0x79bdf3b0, ftLastWriteTime.dwHighDateTime=0x1d5ece7, nFileSizeHigh=0x0, nFileSizeLow=0x9ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogjEslpkwmqBZqS.wav", cAlternateFileName="OGJESL~1.WAV")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dccf7b0, ftCreationTime.dwHighDateTime=0x1d5e90e, ftLastAccessTime.dwLowDateTime=0xaeb61c60, ftLastAccessTime.dwHighDateTime=0x1d5ea3e, ftLastWriteTime.dwLowDateTime=0xaeb61c60, ftLastWriteTime.dwHighDateTime=0x1d5ea3e, nFileSizeHigh=0x0, nFileSizeLow=0x6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="p3Yo3 uYiJt.wav", cAlternateFileName="P3YO3U~1.WAV")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b2f660, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0xaee08c70, ftLastAccessTime.dwHighDateTime=0x1d5eddb, ftLastWriteTime.dwLowDateTime=0xaee08c70, ftLastWriteTime.dwHighDateTime=0x1d5eddb, nFileSizeHigh=0x0, nFileSizeLow=0x13509, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scvd6is4w8U.m4a", cAlternateFileName="SCVD6I~1.M4A")) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.027] FindClose (in: hFindFile=0x169d938 | out: hFindFile=0x169d938) returned 1 [0061.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4", lpFilePart=0x0) returned 0x30 [0061.027] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d938 [0061.028] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42e6feb0, ftCreationTime.dwHighDateTime=0x1d5e7d6, ftLastAccessTime.dwLowDateTime=0x6485f500, ftLastAccessTime.dwHighDateTime=0x1d5ec7f, ftLastWriteTime.dwLowDateTime=0x6485f500, ftLastWriteTime.dwHighDateTime=0x1d5ec7f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.028] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585be20, ftCreationTime.dwHighDateTime=0x1d5eb5b, ftLastAccessTime.dwLowDateTime=0xd7448020, ftLastAccessTime.dwHighDateTime=0x1d5effe, ftLastWriteTime.dwLowDateTime=0xd7448020, ftLastWriteTime.dwHighDateTime=0x1d5effe, nFileSizeHigh=0x0, nFileSizeLow=0xe596, dwReserved0=0x0, dwReserved1=0x0, cFileName="4GYCYXn0.m4a", cAlternateFileName="")) returned 1 [0061.075] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="acoLoVSSCXH86sfEAk", cAlternateFileName="ACOLOV~1")) returned 1 [0061.075] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd734c770, ftCreationTime.dwHighDateTime=0x1d5f0a8, ftLastAccessTime.dwLowDateTime=0x16707350, ftLastAccessTime.dwHighDateTime=0x1d5e0ad, ftLastWriteTime.dwLowDateTime=0x16707350, ftLastWriteTime.dwHighDateTime=0x1d5e0ad, nFileSizeHigh=0x0, nFileSizeLow=0x8086, dwReserved0=0x0, dwReserved1=0x0, cFileName="HcigmjWHTy.wav", cAlternateFileName="HCIGMJ~1.WAV")) returned 1 [0061.076] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88a88a0, ftCreationTime.dwHighDateTime=0x1d5e22b, ftLastAccessTime.dwLowDateTime=0x44ca1690, ftLastAccessTime.dwHighDateTime=0x1d5e7d6, ftLastWriteTime.dwLowDateTime=0x44ca1690, ftLastWriteTime.dwHighDateTime=0x1d5e7d6, nFileSizeHigh=0x0, nFileSizeLow=0xa72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lNk2M RoL.mp3", cAlternateFileName="LNK2MR~1.MP3")) returned 1 [0061.076] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a1332d0, ftCreationTime.dwHighDateTime=0x1d5ea8e, ftLastAccessTime.dwLowDateTime=0x79bdf3b0, ftLastAccessTime.dwHighDateTime=0x1d5ece7, ftLastWriteTime.dwLowDateTime=0x79bdf3b0, ftLastWriteTime.dwHighDateTime=0x1d5ece7, nFileSizeHigh=0x0, nFileSizeLow=0x9ee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogjEslpkwmqBZqS.wav", cAlternateFileName="OGJESL~1.WAV")) returned 1 [0061.076] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dccf7b0, ftCreationTime.dwHighDateTime=0x1d5e90e, ftLastAccessTime.dwLowDateTime=0xaeb61c60, ftLastAccessTime.dwHighDateTime=0x1d5ea3e, ftLastWriteTime.dwLowDateTime=0xaeb61c60, ftLastWriteTime.dwHighDateTime=0x1d5ea3e, nFileSizeHigh=0x0, nFileSizeLow=0x6c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="p3Yo3 uYiJt.wav", cAlternateFileName="P3YO3U~1.WAV")) returned 1 [0061.076] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b2f660, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0xaee08c70, ftLastAccessTime.dwHighDateTime=0x1d5eddb, ftLastWriteTime.dwLowDateTime=0xaee08c70, ftLastWriteTime.dwHighDateTime=0x1d5eddb, nFileSizeHigh=0x0, nFileSizeLow=0x13509, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scvd6is4w8U.m4a", cAlternateFileName="SCVD6I~1.M4A")) returned 1 [0061.076] FindNextFileW (in: hFindFile=0x169d938, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b2f660, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0xaee08c70, ftLastAccessTime.dwHighDateTime=0x1d5eddb, ftLastWriteTime.dwLowDateTime=0xaee08c70, ftLastWriteTime.dwHighDateTime=0x1d5eddb, nFileSizeHigh=0x0, nFileSizeLow=0x13509, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scvd6is4w8U.m4a", cAlternateFileName="SCVD6I~1.M4A")) returned 0 [0061.076] FindClose (in: hFindFile=0x169d938 | out: hFindFile=0x169d938) returned 1 [0061.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", lpFilePart=0x0) returned 0x3e [0061.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ohrfw4wok-ruuqrf3js4\\lnk2m rol.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.077] GetFileType (hFile=0x2e4) returned 0x1 [0061.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.077] GetFileType (hFile=0x2e4) returned 0x1 [0061.077] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xa72c [0061.077] ReadFile (in: hFile=0x2e4, lpBuffer=0x35366dc, nNumberOfBytesToRead=0xa72c, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x35366dc*, lpNumberOfBytesRead=0x138e714*=0xa72c, lpOverlapped=0x0) returned 1 [0061.077] CloseHandle (hObject=0x2e4) returned 1 [0061.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", lpFilePart=0x0) returned 0x3e [0061.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ohrfw4wok-ruuqrf3js4\\lnk2m rol.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.179] GetFileType (hFile=0x2e4) returned 0x1 [0061.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.179] GetFileType (hFile=0x2e4) returned 0x1 [0061.180] WriteFile (in: hFile=0x2e4, lpBuffer=0x32d2214*, nNumberOfBytesToWrite=0xa730, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x32d2214*, lpNumberOfBytesWritten=0x138e708*=0xa730, lpOverlapped=0x0) returned 1 [0061.181] CloseHandle (hObject=0x2e4) returned 1 [0061.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3", lpFilePart=0x0) returned 0x3e [0061.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3.a", lpFilePart=0x0) returned 0x40 [0061.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ohrfw4wok-ruuqrf3js4\\lnk2m rol.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa88a88a0, ftCreationTime.dwHighDateTime=0x1d5e22b, ftLastAccessTime.dwLowDateTime=0x44ca1690, ftLastAccessTime.dwHighDateTime=0x1d5e7d6, ftLastWriteTime.dwLowDateTime=0xd5696ec9, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa730)) returned 1 [0061.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.183] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ohrfw4wok-ruuqrf3js4\\lnk2m rol.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\lNk2M RoL.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ohrfw4wok-ruuqrf3js4\\lnk2m rol.mp3.a")) returned 1 [0061.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk", lpFilePart=0x0) returned 0x43 [0061.184] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0061.184] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.184] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc536c0, ftCreationTime.dwHighDateTime=0x1d5e2ed, ftLastAccessTime.dwLowDateTime=0x8e2a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e6a5, ftLastWriteTime.dwLowDateTime=0x8e2a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e6a5, nFileSizeHigh=0x0, nFileSizeLow=0x13a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="u_TOkeEsih.m4a", cAlternateFileName="U_TOKE~1.M4A")) returned 1 [0061.184] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.185] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0061.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk", lpFilePart=0x0) returned 0x43 [0061.185] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\OhrFw4wOk-ruuQrf3jS4\\acoLoVSSCXH86sfEAk\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dbf8 [0061.185] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x55c94f00, ftCreationTime.dwHighDateTime=0x1d5e548, ftLastAccessTime.dwLowDateTime=0xca1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d5e8bb, ftLastWriteTime.dwLowDateTime=0xca1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d5e8bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.185] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc536c0, ftCreationTime.dwHighDateTime=0x1d5e2ed, ftLastAccessTime.dwLowDateTime=0x8e2a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e6a5, ftLastWriteTime.dwLowDateTime=0x8e2a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e6a5, nFileSizeHigh=0x0, nFileSizeLow=0x13a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="u_TOkeEsih.m4a", cAlternateFileName="U_TOKE~1.M4A")) returned 1 [0061.185] FindNextFileW (in: hFindFile=0x169dbf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc536c0, ftCreationTime.dwHighDateTime=0x1d5e2ed, ftLastAccessTime.dwLowDateTime=0x8e2a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e6a5, ftLastWriteTime.dwLowDateTime=0x8e2a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e6a5, nFileSizeHigh=0x0, nFileSizeLow=0x13a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="u_TOkeEsih.m4a", cAlternateFileName="U_TOKE~1.M4A")) returned 0 [0061.186] FindClose (in: hFindFile=0x169dbf8 | out: hFindFile=0x169dbf8) returned 1 [0061.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk", lpFilePart=0x0) returned 0x23 [0061.186] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0061.186] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.186] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebd9f10, ftCreationTime.dwHighDateTime=0x1d5e5e8, ftLastAccessTime.dwLowDateTime=0x8d483b0, ftLastAccessTime.dwHighDateTime=0x1d5e186, ftLastWriteTime.dwLowDateTime=0x8d483b0, ftLastWriteTime.dwHighDateTime=0x1d5e186, nFileSizeHigh=0x0, nFileSizeLow=0xf3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhnf512tBu -TkP05o.mp3", cAlternateFileName="HHNF51~1.MP3")) returned 1 [0061.186] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6446540, ftCreationTime.dwHighDateTime=0x1d5e452, ftLastAccessTime.dwLowDateTime=0xfcb0d190, ftLastAccessTime.dwHighDateTime=0x1d5ea74, ftLastWriteTime.dwLowDateTime=0xfcb0d190, ftLastWriteTime.dwHighDateTime=0x1d5ea74, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="M7O-hH-jTha.mp3", cAlternateFileName="M7O-HH~1.MP3")) returned 1 [0061.186] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8802f0, ftCreationTime.dwHighDateTime=0x1d5e22e, ftLastAccessTime.dwLowDateTime=0xb7f34950, ftLastAccessTime.dwHighDateTime=0x1d5e742, ftLastWriteTime.dwLowDateTime=0xb7f34950, ftLastWriteTime.dwHighDateTime=0x1d5e742, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vXLvTjcS3Ag.m4a", cAlternateFileName="VXLVTJ~1.M4A")) returned 1 [0061.187] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587f8260, ftCreationTime.dwHighDateTime=0x1d5e88a, ftLastAccessTime.dwLowDateTime=0x16c48170, ftLastAccessTime.dwHighDateTime=0x1d5ee7c, ftLastWriteTime.dwLowDateTime=0x16c48170, ftLastWriteTime.dwHighDateTime=0x1d5ee7c, nFileSizeHigh=0x0, nFileSizeLow=0x62e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3Yf_Cxb4XB.wav", cAlternateFileName="X3YF_C~1.WAV")) returned 1 [0061.187] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde7a55b0, ftCreationTime.dwHighDateTime=0x1d5e2cd, ftLastAccessTime.dwLowDateTime=0x16f355f0, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x16f355f0, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x114bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywnGlVmTg5dBkrh786ia.m4a", cAlternateFileName="YWNGLV~1.M4A")) returned 1 [0061.187] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.187] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0061.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk", lpFilePart=0x0) returned 0x23 [0061.187] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0061.187] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4448bb50, ftCreationTime.dwHighDateTime=0x1d5ece9, ftLastAccessTime.dwLowDateTime=0x72d11480, ftLastAccessTime.dwHighDateTime=0x1d5ec63, ftLastWriteTime.dwLowDateTime=0x72d11480, ftLastWriteTime.dwHighDateTime=0x1d5ec63, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.187] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebd9f10, ftCreationTime.dwHighDateTime=0x1d5e5e8, ftLastAccessTime.dwLowDateTime=0x8d483b0, ftLastAccessTime.dwHighDateTime=0x1d5e186, ftLastWriteTime.dwLowDateTime=0x8d483b0, ftLastWriteTime.dwHighDateTime=0x1d5e186, nFileSizeHigh=0x0, nFileSizeLow=0xf3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhnf512tBu -TkP05o.mp3", cAlternateFileName="HHNF51~1.MP3")) returned 1 [0061.188] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6446540, ftCreationTime.dwHighDateTime=0x1d5e452, ftLastAccessTime.dwLowDateTime=0xfcb0d190, ftLastAccessTime.dwHighDateTime=0x1d5ea74, ftLastWriteTime.dwLowDateTime=0xfcb0d190, ftLastWriteTime.dwHighDateTime=0x1d5ea74, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="M7O-hH-jTha.mp3", cAlternateFileName="M7O-HH~1.MP3")) returned 1 [0061.188] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8802f0, ftCreationTime.dwHighDateTime=0x1d5e22e, ftLastAccessTime.dwLowDateTime=0xb7f34950, ftLastAccessTime.dwHighDateTime=0x1d5e742, ftLastWriteTime.dwLowDateTime=0xb7f34950, ftLastWriteTime.dwHighDateTime=0x1d5e742, nFileSizeHigh=0x0, nFileSizeLow=0x17a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vXLvTjcS3Ag.m4a", cAlternateFileName="VXLVTJ~1.M4A")) returned 1 [0061.188] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587f8260, ftCreationTime.dwHighDateTime=0x1d5e88a, ftLastAccessTime.dwLowDateTime=0x16c48170, ftLastAccessTime.dwHighDateTime=0x1d5ee7c, ftLastWriteTime.dwLowDateTime=0x16c48170, ftLastWriteTime.dwHighDateTime=0x1d5ee7c, nFileSizeHigh=0x0, nFileSizeLow=0x62e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3Yf_Cxb4XB.wav", cAlternateFileName="X3YF_C~1.WAV")) returned 1 [0061.188] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde7a55b0, ftCreationTime.dwHighDateTime=0x1d5e2cd, ftLastAccessTime.dwLowDateTime=0x16f355f0, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x16f355f0, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x114bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywnGlVmTg5dBkrh786ia.m4a", cAlternateFileName="YWNGLV~1.M4A")) returned 1 [0061.188] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde7a55b0, ftCreationTime.dwHighDateTime=0x1d5e2cd, ftLastAccessTime.dwLowDateTime=0x16f355f0, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x16f355f0, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x114bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ywnGlVmTg5dBkrh786ia.m4a", cAlternateFileName="YWNGLV~1.M4A")) returned 0 [0061.188] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0061.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", lpFilePart=0x0) returned 0x3a [0061.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\hhnf512tbu -tkp05o.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.189] GetFileType (hFile=0x2e4) returned 0x1 [0061.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.189] GetFileType (hFile=0x2e4) returned 0x1 [0061.189] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xf3ab [0061.189] ReadFile (in: hFile=0x2e4, lpBuffer=0x32e0058, nNumberOfBytesToRead=0xf3ab, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x32e0058*, lpNumberOfBytesRead=0x138e714*=0xf3ab, lpOverlapped=0x0) returned 1 [0061.189] CloseHandle (hObject=0x2e4) returned 1 [0061.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", lpFilePart=0x0) returned 0x3a [0061.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\hhnf512tbu -tkp05o.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.208] GetFileType (hFile=0x2e4) returned 0x1 [0061.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.208] GetFileType (hFile=0x2e4) returned 0x1 [0061.209] WriteFile (in: hFile=0x2e4, lpBuffer=0x335aac4*, nNumberOfBytesToWrite=0xf3b0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x335aac4*, lpNumberOfBytesWritten=0x138e708*=0xf3b0, lpOverlapped=0x0) returned 1 [0061.210] CloseHandle (hObject=0x2e4) returned 1 [0061.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3", lpFilePart=0x0) returned 0x3a [0061.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3.a", lpFilePart=0x0) returned 0x3c [0061.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\hhnf512tbu -tkp05o.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebd9f10, ftCreationTime.dwHighDateTime=0x1d5e5e8, ftLastAccessTime.dwLowDateTime=0x8d483b0, ftLastAccessTime.dwHighDateTime=0x1d5e186, ftLastWriteTime.dwLowDateTime=0xd56e33c9, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf3b0)) returned 1 [0061.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.212] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\hhnf512tbu -tkp05o.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\hhnf512tBu -TkP05o.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\hhnf512tbu -tkp05o.mp3.a")) returned 1 [0061.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", lpFilePart=0x0) returned 0x33 [0061.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\m7o-hh-jtha.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.213] GetFileType (hFile=0x2e4) returned 0x1 [0061.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.213] GetFileType (hFile=0x2e4) returned 0x1 [0061.213] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xb61 [0061.213] ReadFile (in: hFile=0x2e4, lpBuffer=0x336aeac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x336aeac*, lpNumberOfBytesRead=0x138e714*=0xb61, lpOverlapped=0x0) returned 1 [0061.213] CloseHandle (hObject=0x2e4) returned 1 [0061.276] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.276] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.276] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", lpFilePart=0x0) returned 0x33 [0061.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\m7o-hh-jtha.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.277] GetFileType (hFile=0x2e4) returned 0x1 [0061.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.277] GetFileType (hFile=0x2e4) returned 0x1 [0061.277] WriteFile (in: hFile=0x2e4, lpBuffer=0x33bc7d4*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x138e6dc, lpOverlapped=0x0 | out: lpBuffer=0x33bc7d4*, lpNumberOfBytesWritten=0x138e6dc*=0xb70, lpOverlapped=0x0) returned 1 [0061.278] CloseHandle (hObject=0x2e4) returned 1 [0061.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3", lpFilePart=0x0) returned 0x33 [0061.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3.a", lpFilePart=0x0) returned 0x35 [0061.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\m7o-hh-jtha.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6446540, ftCreationTime.dwHighDateTime=0x1d5e452, ftLastAccessTime.dwLowDateTime=0xfcb0d190, ftLastAccessTime.dwHighDateTime=0x1d5ea74, ftLastWriteTime.dwLowDateTime=0xd57a203e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xb70)) returned 1 [0061.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.280] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\m7o-hh-jtha.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\qSbN7sk\\M7O-hH-jTha.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\qsbn7sk\\m7o-hh-jtha.mp3.a")) returned 1 [0061.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa", lpFilePart=0x0) returned 0x2e [0061.280] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0061.280] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.280] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed11f10, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xf812c70, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0xf812c70, ftLastWriteTime.dwHighDateTime=0x1d5e5b6, nFileSizeHigh=0x0, nFileSizeLow=0xf7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="3yt3ueS.mp3", cAlternateFileName="")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecd17b0, ftCreationTime.dwHighDateTime=0x1d5ebcf, ftLastAccessTime.dwLowDateTime=0x1497ba90, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0x1497ba90, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0xd84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4wt5QOTj1Ctz.mp3", cAlternateFileName="4WT5QO~1.MP3")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f7d490, ftCreationTime.dwHighDateTime=0x1d5ee6e, ftLastAccessTime.dwLowDateTime=0xbad1c090, ftLastAccessTime.dwHighDateTime=0x1d5e894, ftLastWriteTime.dwLowDateTime=0xbad1c090, ftLastWriteTime.dwHighDateTime=0x1d5e894, nFileSizeHigh=0x0, nFileSizeLow=0x3d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="89oIRz4N1t wsgaYd.mp3", cAlternateFileName="89OIRZ~1.MP3")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVSeyLKc1Js", cAlternateFileName="BVSEYL~1")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c018260, ftCreationTime.dwHighDateTime=0x1d5eb10, ftLastAccessTime.dwLowDateTime=0xc991d4f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xc991d4f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x13d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hIRIoA.m4a", cAlternateFileName="")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iiIFP8WyHtLZVuP", cAlternateFileName="IIIFP8~1")) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iiIFP8WyHtLZVuP", cAlternateFileName="IIIFP8~1")) returned 0 [0061.281] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0061.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0061.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa", lpFilePart=0x0) returned 0x2e [0061.282] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0061.282] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544a420, ftCreationTime.dwHighDateTime=0x1d5e260, ftLastAccessTime.dwLowDateTime=0x75f48e20, ftLastAccessTime.dwHighDateTime=0x1d5f0a1, ftLastWriteTime.dwLowDateTime=0x75f48e20, ftLastWriteTime.dwHighDateTime=0x1d5f0a1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.282] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed11f10, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xf812c70, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0xf812c70, ftLastWriteTime.dwHighDateTime=0x1d5e5b6, nFileSizeHigh=0x0, nFileSizeLow=0xf7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="3yt3ueS.mp3", cAlternateFileName="")) returned 1 [0061.282] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecd17b0, ftCreationTime.dwHighDateTime=0x1d5ebcf, ftLastAccessTime.dwLowDateTime=0x1497ba90, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0x1497ba90, ftLastWriteTime.dwHighDateTime=0x1d5f0e6, nFileSizeHigh=0x0, nFileSizeLow=0xd84e, dwReserved0=0x0, dwReserved1=0x0, cFileName="4wt5QOTj1Ctz.mp3", cAlternateFileName="4WT5QO~1.MP3")) returned 1 [0061.282] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f7d490, ftCreationTime.dwHighDateTime=0x1d5ee6e, ftLastAccessTime.dwLowDateTime=0xbad1c090, ftLastAccessTime.dwHighDateTime=0x1d5e894, ftLastWriteTime.dwLowDateTime=0xbad1c090, ftLastWriteTime.dwHighDateTime=0x1d5e894, nFileSizeHigh=0x0, nFileSizeLow=0x3d45, dwReserved0=0x0, dwReserved1=0x0, cFileName="89oIRz4N1t wsgaYd.mp3", cAlternateFileName="89OIRZ~1.MP3")) returned 1 [0061.283] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVSeyLKc1Js", cAlternateFileName="BVSEYL~1")) returned 1 [0061.283] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c018260, ftCreationTime.dwHighDateTime=0x1d5eb10, ftLastAccessTime.dwLowDateTime=0xc991d4f0, ftLastAccessTime.dwHighDateTime=0x1d5e7a7, ftLastWriteTime.dwLowDateTime=0xc991d4f0, ftLastWriteTime.dwHighDateTime=0x1d5e7a7, nFileSizeHigh=0x0, nFileSizeLow=0x13d4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="hIRIoA.m4a", cAlternateFileName="")) returned 1 [0061.283] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iiIFP8WyHtLZVuP", cAlternateFileName="IIIFP8~1")) returned 1 [0061.283] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.283] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0061.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0061.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0061.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", lpFilePart=0x0) returned 0x3a [0061.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\3yt3ues.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.283] GetFileType (hFile=0x2e4) returned 0x1 [0061.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.283] GetFileType (hFile=0x2e4) returned 0x1 [0061.283] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xf7ec [0061.284] ReadFile (in: hFile=0x2e4, lpBuffer=0x33bfba0, nNumberOfBytesToRead=0xf7ec, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33bfba0*, lpNumberOfBytesRead=0x138e714*=0xf7ec, lpOverlapped=0x0) returned 1 [0061.284] CloseHandle (hObject=0x2e4) returned 1 [0061.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.301] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", lpFilePart=0x0) returned 0x3a [0061.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.301] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\3yt3ues.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.302] GetFileType (hFile=0x2e4) returned 0x1 [0061.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.302] GetFileType (hFile=0x2e4) returned 0x1 [0061.302] WriteFile (in: hFile=0x2e4, lpBuffer=0x343b16c*, nNumberOfBytesToWrite=0xf7f0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x343b16c*, lpNumberOfBytesWritten=0x138e708*=0xf7f0, lpOverlapped=0x0) returned 1 [0061.304] CloseHandle (hObject=0x2e4) returned 1 [0061.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3", lpFilePart=0x0) returned 0x3a [0061.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3.a", lpFilePart=0x0) returned 0x3c [0061.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\3yt3ues.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed11f10, ftCreationTime.dwHighDateTime=0x1d5e26f, ftLastAccessTime.dwLowDateTime=0xf812c70, ftLastAccessTime.dwHighDateTime=0x1d5e5b6, ftLastWriteTime.dwLowDateTime=0xd57c800c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xf7f0)) returned 1 [0061.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.306] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\3yt3ues.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\3yt3ueS.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\3yt3ues.mp3.a")) returned 1 [0061.306] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", lpFilePart=0x0) returned 0x3f [0061.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\4wt5qotj1ctz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.307] GetFileType (hFile=0x2e4) returned 0x1 [0061.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.307] GetFileType (hFile=0x2e4) returned 0x1 [0061.307] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xd84e [0061.307] ReadFile (in: hFile=0x2e4, lpBuffer=0x344ae28, nNumberOfBytesToRead=0xd84e, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x344ae28*, lpNumberOfBytesRead=0x138e714*=0xd84e, lpOverlapped=0x0) returned 1 [0061.307] CloseHandle (hObject=0x2e4) returned 1 [0061.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", lpFilePart=0x0) returned 0x3f [0061.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.374] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\4wt5qotj1ctz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.375] GetFileType (hFile=0x2e4) returned 0x1 [0061.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.375] GetFileType (hFile=0x2e4) returned 0x1 [0061.375] WriteFile (in: hFile=0x2e4, lpBuffer=0x32b9578*, nNumberOfBytesToWrite=0xd850, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x32b9578*, lpNumberOfBytesWritten=0x138e708*=0xd850, lpOverlapped=0x0) returned 1 [0061.377] CloseHandle (hObject=0x2e4) returned 1 [0061.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3", lpFilePart=0x0) returned 0x3f [0061.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3.a", lpFilePart=0x0) returned 0x41 [0061.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\4wt5qotj1ctz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecd17b0, ftCreationTime.dwHighDateTime=0x1d5ebcf, ftLastAccessTime.dwLowDateTime=0x1497ba90, ftLastAccessTime.dwHighDateTime=0x1d5f0e6, ftLastWriteTime.dwLowDateTime=0xd5886d80, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd850)) returned 1 [0061.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.379] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\4wt5qotj1ctz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\4wt5QOTj1Ctz.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\4wt5qotj1ctz.mp3.a")) returned 1 [0061.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", lpFilePart=0x0) returned 0x44 [0061.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.379] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\89oirz4n1t wsgayd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.379] GetFileType (hFile=0x2e4) returned 0x1 [0061.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.379] GetFileType (hFile=0x2e4) returned 0x1 [0061.379] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x3d45 [0061.380] ReadFile (in: hFile=0x2e4, lpBuffer=0x32c72d4, nNumberOfBytesToRead=0x3d45, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x32c72d4*, lpNumberOfBytesRead=0x138e714*=0x3d45, lpOverlapped=0x0) returned 1 [0061.380] CloseHandle (hObject=0x2e4) returned 1 [0061.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", lpFilePart=0x0) returned 0x44 [0061.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0061.472] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\89oirz4n1t wsgayd.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.473] GetFileType (hFile=0x2e4) returned 0x1 [0061.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0061.474] GetFileType (hFile=0x2e4) returned 0x1 [0061.474] WriteFile (in: hFile=0x2e4, lpBuffer=0x33274ac*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x33274ac*, lpNumberOfBytesWritten=0x138e708*=0x3d50, lpOverlapped=0x0) returned 1 [0061.475] CloseHandle (hObject=0x2e4) returned 1 [0061.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3", lpFilePart=0x0) returned 0x44 [0061.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3.a", lpFilePart=0x0) returned 0x46 [0061.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0061.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\89oirz4n1t wsgayd.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f7d490, ftCreationTime.dwHighDateTime=0x1d5ee6e, ftLastAccessTime.dwLowDateTime=0xbad1c090, ftLastAccessTime.dwHighDateTime=0x1d5e894, ftLastWriteTime.dwLowDateTime=0xd596bc1a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x3d50)) returned 1 [0061.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0061.476] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\89oirz4n1t wsgayd.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\89oIRz4N1t wsgaYd.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\89oirz4n1t wsgayd.mp3.a")) returned 1 [0061.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.477] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js", lpFilePart=0x0) returned 0x3a [0061.477] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0061.477] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.477] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c82bcb0, ftCreationTime.dwHighDateTime=0x1d5f068, ftLastAccessTime.dwLowDateTime=0xd5a51f20, ftLastAccessTime.dwHighDateTime=0x1d5e786, ftLastWriteTime.dwLowDateTime=0xd5a51f20, ftLastWriteTime.dwHighDateTime=0x1d5e786, nFileSizeHigh=0x0, nFileSizeLow=0xf1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eOVP69ZLOC.wav", cAlternateFileName="EOVP69~1.WAV")) returned 1 [0061.477] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3dfc00, ftCreationTime.dwHighDateTime=0x1d5e9eb, ftLastAccessTime.dwLowDateTime=0x26c0860, ftLastAccessTime.dwHighDateTime=0x1d5e152, ftLastWriteTime.dwLowDateTime=0x26c0860, ftLastWriteTime.dwHighDateTime=0x1d5e152, nFileSizeHigh=0x0, nFileSizeLow=0xe2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="T7Lk.mp3", cAlternateFileName="")) returned 1 [0061.477] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.477] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0061.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js", lpFilePart=0x0) returned 0x3a [0061.478] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcb8 [0061.478] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb62ded0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0xa8de7560, ftLastAccessTime.dwHighDateTime=0x1d5e9c8, ftLastWriteTime.dwLowDateTime=0xa8de7560, ftLastWriteTime.dwHighDateTime=0x1d5e9c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.478] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c82bcb0, ftCreationTime.dwHighDateTime=0x1d5f068, ftLastAccessTime.dwLowDateTime=0xd5a51f20, ftLastAccessTime.dwHighDateTime=0x1d5e786, ftLastWriteTime.dwLowDateTime=0xd5a51f20, ftLastWriteTime.dwHighDateTime=0x1d5e786, nFileSizeHigh=0x0, nFileSizeLow=0xf1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eOVP69ZLOC.wav", cAlternateFileName="EOVP69~1.WAV")) returned 1 [0061.478] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3dfc00, ftCreationTime.dwHighDateTime=0x1d5e9eb, ftLastAccessTime.dwLowDateTime=0x26c0860, ftLastAccessTime.dwHighDateTime=0x1d5e152, ftLastWriteTime.dwLowDateTime=0x26c0860, ftLastWriteTime.dwHighDateTime=0x1d5e152, nFileSizeHigh=0x0, nFileSizeLow=0xe2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="T7Lk.mp3", cAlternateFileName="")) returned 1 [0061.478] FindNextFileW (in: hFindFile=0x169dcb8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3dfc00, ftCreationTime.dwHighDateTime=0x1d5e9eb, ftLastAccessTime.dwLowDateTime=0x26c0860, ftLastAccessTime.dwHighDateTime=0x1d5e152, ftLastWriteTime.dwLowDateTime=0x26c0860, ftLastWriteTime.dwHighDateTime=0x1d5e152, nFileSizeHigh=0x0, nFileSizeLow=0xe2bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="T7Lk.mp3", cAlternateFileName="")) returned 0 [0061.478] FindClose (in: hFindFile=0x169dcb8 | out: hFindFile=0x169dcb8) returned 1 [0061.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", lpFilePart=0x0) returned 0x43 [0061.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0061.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\bvseylkc1js\\t7lk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.479] GetFileType (hFile=0x2e4) returned 0x1 [0061.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0061.479] GetFileType (hFile=0x2e4) returned 0x1 [0061.479] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0xe2bc [0061.479] ReadFile (in: hFile=0x2e4, lpBuffer=0x332ce2c, nNumberOfBytesToRead=0xe2bc, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x332ce2c*, lpNumberOfBytesRead=0x138e6a0*=0xe2bc, lpOverlapped=0x0) returned 1 [0061.479] CloseHandle (hObject=0x2e4) returned 1 [0061.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", lpFilePart=0x0) returned 0x43 [0061.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0061.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\bvseylkc1js\\t7lk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.576] GetFileType (hFile=0x2e4) returned 0x1 [0061.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0061.576] GetFileType (hFile=0x2e4) returned 0x1 [0061.576] WriteFile (in: hFile=0x2e4, lpBuffer=0x33a4468*, nNumberOfBytesToWrite=0xe2c0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x33a4468*, lpNumberOfBytesWritten=0x138e694*=0xe2c0, lpOverlapped=0x0) returned 1 [0061.578] CloseHandle (hObject=0x2e4) returned 1 [0061.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3", lpFilePart=0x0) returned 0x43 [0061.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3.a", lpFilePart=0x0) returned 0x45 [0061.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0061.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\bvseylkc1js\\t7lk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3dfc00, ftCreationTime.dwHighDateTime=0x1d5e9eb, ftLastAccessTime.dwLowDateTime=0x26c0860, ftLastAccessTime.dwHighDateTime=0x1d5e152, ftLastWriteTime.dwLowDateTime=0xd5a76bdd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe2c0)) returned 1 [0061.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0061.580] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\bvseylkc1js\\t7lk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\bVSeyLKc1Js\\T7Lk.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\bvseylkc1js\\t7lk.mp3.a")) returned 1 [0061.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP", lpFilePart=0x0) returned 0x3e [0061.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0061.581] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.581] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c58d80, ftCreationTime.dwHighDateTime=0x1d5e36a, ftLastAccessTime.dwLowDateTime=0x41f74950, ftLastAccessTime.dwHighDateTime=0x1d5eeee, ftLastWriteTime.dwLowDateTime=0x41f74950, ftLastWriteTime.dwHighDateTime=0x1d5eeee, nFileSizeHigh=0x0, nFileSizeLow=0x16b69, dwReserved0=0x0, dwReserved1=0x0, cFileName="l13oWK1xWeLGnA.wav", cAlternateFileName="L13OWK~1.WAV")) returned 1 [0061.581] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c9a20, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0xd8d6abc0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0xd8d6abc0, ftLastWriteTime.dwHighDateTime=0x1d5e851, nFileSizeHigh=0x0, nFileSizeLow=0x6a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJiStawjzVXqPQ_gXLW.mp3", cAlternateFileName="NJISTA~1.MP3")) returned 1 [0061.581] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x127c0130, ftCreationTime.dwHighDateTime=0x1d5eb2d, ftLastAccessTime.dwLowDateTime=0x5e33db10, ftLastAccessTime.dwHighDateTime=0x1d5ef70, ftLastWriteTime.dwLowDateTime=0x5e33db10, ftLastWriteTime.dwHighDateTime=0x1d5ef70, nFileSizeHigh=0x0, nFileSizeLow=0x1042b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEVqGhOZs6DE5gW.mp3", cAlternateFileName="UEVQGH~1.MP3")) returned 1 [0061.581] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.581] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0061.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0061.582] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP", lpFilePart=0x0) returned 0x3e [0061.582] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0061.582] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9ad9f0, ftCreationTime.dwHighDateTime=0x1d5e1ae, ftLastAccessTime.dwLowDateTime=0xf2e0df20, ftLastAccessTime.dwHighDateTime=0x1d5ef60, ftLastWriteTime.dwLowDateTime=0xf2e0df20, ftLastWriteTime.dwHighDateTime=0x1d5ef60, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.582] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c58d80, ftCreationTime.dwHighDateTime=0x1d5e36a, ftLastAccessTime.dwLowDateTime=0x41f74950, ftLastAccessTime.dwHighDateTime=0x1d5eeee, ftLastWriteTime.dwLowDateTime=0x41f74950, ftLastWriteTime.dwHighDateTime=0x1d5eeee, nFileSizeHigh=0x0, nFileSizeLow=0x16b69, dwReserved0=0x0, dwReserved1=0x0, cFileName="l13oWK1xWeLGnA.wav", cAlternateFileName="L13OWK~1.WAV")) returned 1 [0061.582] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c9a20, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0xd8d6abc0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0xd8d6abc0, ftLastWriteTime.dwHighDateTime=0x1d5e851, nFileSizeHigh=0x0, nFileSizeLow=0x6a04, dwReserved0=0x0, dwReserved1=0x0, cFileName="nJiStawjzVXqPQ_gXLW.mp3", cAlternateFileName="NJISTA~1.MP3")) returned 1 [0061.582] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x127c0130, ftCreationTime.dwHighDateTime=0x1d5eb2d, ftLastAccessTime.dwLowDateTime=0x5e33db10, ftLastAccessTime.dwHighDateTime=0x1d5ef70, ftLastWriteTime.dwLowDateTime=0x5e33db10, ftLastWriteTime.dwHighDateTime=0x1d5ef70, nFileSizeHigh=0x0, nFileSizeLow=0x1042b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEVqGhOZs6DE5gW.mp3", cAlternateFileName="UEVQGH~1.MP3")) returned 1 [0061.582] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x127c0130, ftCreationTime.dwHighDateTime=0x1d5eb2d, ftLastAccessTime.dwLowDateTime=0x5e33db10, ftLastAccessTime.dwHighDateTime=0x1d5ef70, ftLastWriteTime.dwLowDateTime=0x5e33db10, ftLastWriteTime.dwHighDateTime=0x1d5ef70, nFileSizeHigh=0x0, nFileSizeLow=0x1042b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEVqGhOZs6DE5gW.mp3", cAlternateFileName="UEVQGH~1.MP3")) returned 0 [0061.583] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0061.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0061.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0061.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", lpFilePart=0x0) returned 0x56 [0061.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0061.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\njistawjzvxqpq_gxlw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.583] GetFileType (hFile=0x2e4) returned 0x1 [0061.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0061.583] GetFileType (hFile=0x2e4) returned 0x1 [0061.583] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x6a04 [0061.583] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b49b0, nNumberOfBytesToRead=0x6a04, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x33b49b0*, lpNumberOfBytesRead=0x138e6a0*=0x6a04, lpOverlapped=0x0) returned 1 [0061.583] CloseHandle (hObject=0x2e4) returned 1 [0061.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", lpFilePart=0x0) returned 0x56 [0061.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0061.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\njistawjzvxqpq_gxlw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.600] GetFileType (hFile=0x2e4) returned 0x1 [0061.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0061.600] GetFileType (hFile=0x2e4) returned 0x1 [0061.600] WriteFile (in: hFile=0x2e4, lpBuffer=0x34229e8*, nNumberOfBytesToWrite=0x6a10, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x34229e8*, lpNumberOfBytesWritten=0x138e694*=0x6a10, lpOverlapped=0x0) returned 1 [0061.601] CloseHandle (hObject=0x2e4) returned 1 [0061.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3", lpFilePart=0x0) returned 0x56 [0061.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3.a", lpFilePart=0x0) returned 0x58 [0061.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0061.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\njistawjzvxqpq_gxlw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98c9a20, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0xd8d6abc0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0xd5a9ce6c, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x6a10)) returned 1 [0061.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0061.603] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\njistawjzvxqpq_gxlw.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\nJiStawjzVXqPQ_gXLW.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\njistawjzvxqpq_gxlw.mp3.a")) returned 1 [0061.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", lpFilePart=0x0) returned 0x52 [0061.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0061.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\uevqghozs6de5gw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.603] GetFileType (hFile=0x2e4) returned 0x1 [0061.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0061.603] GetFileType (hFile=0x2e4) returned 0x1 [0061.603] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x1042b [0061.603] ReadFile (in: hFile=0x2e4, lpBuffer=0x34299e8, nNumberOfBytesToRead=0x1042b, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x34299e8*, lpNumberOfBytesRead=0x138e6a0*=0x1042b, lpOverlapped=0x0) returned 1 [0061.604] CloseHandle (hObject=0x2e4) returned 1 [0061.668] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0061.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0061.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", lpFilePart=0x0) returned 0x52 [0061.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0061.729] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\uevqghozs6de5gw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.730] GetFileType (hFile=0x2e4) returned 0x1 [0061.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0061.730] GetFileType (hFile=0x2e4) returned 0x1 [0061.730] WriteFile (in: hFile=0x2e4, lpBuffer=0x34a7478*, nNumberOfBytesToWrite=0x10430, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x34a7478*, lpNumberOfBytesWritten=0x138e694*=0x10430, lpOverlapped=0x0) returned 1 [0061.732] CloseHandle (hObject=0x2e4) returned 1 [0061.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3", lpFilePart=0x0) returned 0x52 [0061.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3.a", lpFilePart=0x0) returned 0x54 [0061.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0061.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\uevqghozs6de5gw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x127c0130, ftCreationTime.dwHighDateTime=0x1d5eb2d, ftLastAccessTime.dwLowDateTime=0x5e33db10, ftLastAccessTime.dwHighDateTime=0x1d5ef70, ftLastWriteTime.dwLowDateTime=0xd5bf43cb, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x10430)) returned 1 [0061.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0061.734] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\uevqghozs6de5gw.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\7Xz8A\\uI9AcgegV4QGJeFzPa\\iiIFP8WyHtLZVuP\\UEVqGhOZs6DE5gW.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\7xz8a\\ui9acgegv4qgjefzpa\\iiifp8wyhtlzvup\\uevqghozs6de5gw.mp3.a")) returned 1 [0061.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.735] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg", lpFilePart=0x0) returned 0x2a [0061.735] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0061.735] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.735] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf8a90, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x28841390, ftLastAccessTime.dwHighDateTime=0x1d5e6d3, ftLastWriteTime.dwLowDateTime=0x28841390, ftLastWriteTime.dwHighDateTime=0x1d5e6d3, nFileSizeHigh=0x0, nFileSizeLow=0x55e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3 6nt ZrFl64-tuE4.mp3", cAlternateFileName="XW36NT~1.MP3")) returned 1 [0061.735] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b15670, ftCreationTime.dwHighDateTime=0x1d5eb67, ftLastAccessTime.dwLowDateTime=0x58a60380, ftLastAccessTime.dwHighDateTime=0x1d5e363, ftLastWriteTime.dwLowDateTime=0x58a60380, ftLastWriteTime.dwHighDateTime=0x1d5e363, nFileSizeHigh=0x0, nFileSizeLow=0x16b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="yoRDyP-.mp3", cAlternateFileName="")) returned 1 [0061.735] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.735] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.736] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg", lpFilePart=0x0) returned 0x2a [0061.736] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169da78 [0061.736] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc17308a0, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0x8cf79ac0, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x8cf79ac0, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf8a90, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x28841390, ftLastAccessTime.dwHighDateTime=0x1d5e6d3, ftLastWriteTime.dwLowDateTime=0x28841390, ftLastWriteTime.dwHighDateTime=0x1d5e6d3, nFileSizeHigh=0x0, nFileSizeLow=0x55e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="xW3 6nt ZrFl64-tuE4.mp3", cAlternateFileName="XW36NT~1.MP3")) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b15670, ftCreationTime.dwHighDateTime=0x1d5eb67, ftLastAccessTime.dwLowDateTime=0x58a60380, ftLastAccessTime.dwHighDateTime=0x1d5e363, ftLastWriteTime.dwLowDateTime=0x58a60380, ftLastWriteTime.dwHighDateTime=0x1d5e363, nFileSizeHigh=0x0, nFileSizeLow=0x16b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="yoRDyP-.mp3", cAlternateFileName="")) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x169da78, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b15670, ftCreationTime.dwHighDateTime=0x1d5eb67, ftLastAccessTime.dwLowDateTime=0x58a60380, ftLastAccessTime.dwHighDateTime=0x1d5e363, ftLastWriteTime.dwLowDateTime=0x58a60380, ftLastWriteTime.dwHighDateTime=0x1d5e363, nFileSizeHigh=0x0, nFileSizeLow=0x16b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="yoRDyP-.mp3", cAlternateFileName="")) returned 0 [0061.736] FindClose (in: hFindFile=0x169da78 | out: hFindFile=0x169da78) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.737] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", lpFilePart=0x0) returned 0x42 [0061.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\xw3 6nt zrfl64-tue4.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.737] GetFileType (hFile=0x2e4) returned 0x1 [0061.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.737] GetFileType (hFile=0x2e4) returned 0x1 [0061.737] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x55e1 [0061.739] ReadFile (in: hFile=0x2e4, lpBuffer=0x32aae9c, nNumberOfBytesToRead=0x55e1, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32aae9c*, lpNumberOfBytesRead=0x138e788*=0x55e1, lpOverlapped=0x0) returned 1 [0061.740] CloseHandle (hObject=0x2e4) returned 1 [0061.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0061.831] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0061.831] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", lpFilePart=0x0) returned 0x42 [0061.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0061.831] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\xw3 6nt zrfl64-tue4.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.832] GetFileType (hFile=0x2e4) returned 0x1 [0061.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0061.832] GetFileType (hFile=0x2e4) returned 0x1 [0061.832] WriteFile (in: hFile=0x2e4, lpBuffer=0x3312b94*, nNumberOfBytesToWrite=0x55f0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x3312b94*, lpNumberOfBytesWritten=0x138e77c*=0x55f0, lpOverlapped=0x0) returned 1 [0061.834] CloseHandle (hObject=0x2e4) returned 1 [0061.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3", lpFilePart=0x0) returned 0x42 [0061.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3.a", lpFilePart=0x0) returned 0x44 [0061.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0061.835] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\xw3 6nt zrfl64-tue4.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacf8a90, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0x28841390, ftLastAccessTime.dwHighDateTime=0x1d5e6d3, ftLastWriteTime.dwLowDateTime=0xd5cd9216, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x55f0)) returned 1 [0061.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0061.835] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\xw3 6nt zrfl64-tue4.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\xW3 6nt ZrFl64-tuE4.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\xw3 6nt zrfl64-tue4.mp3.a")) returned 1 [0061.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", lpFilePart=0x0) returned 0x36 [0061.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0061.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\yordyp-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.836] GetFileType (hFile=0x2e4) returned 0x1 [0061.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0061.836] GetFileType (hFile=0x2e4) returned 0x1 [0061.836] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x16b27 [0061.837] ReadFile (in: hFile=0x2e4, lpBuffer=0x452ccf0, nNumberOfBytesToRead=0x16b27, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x452ccf0*, lpNumberOfBytesRead=0x138e788*=0x16b27, lpOverlapped=0x0) returned 1 [0061.837] CloseHandle (hObject=0x2e4) returned 1 [0061.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0061.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0061.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0061.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0061.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", lpFilePart=0x0) returned 0x36 [0061.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0061.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\yordyp-.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.911] GetFileType (hFile=0x2e4) returned 0x1 [0061.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0061.911] GetFileType (hFile=0x2e4) returned 0x1 [0061.911] WriteFile (in: hFile=0x2e4, lpBuffer=0x4271a48*, nNumberOfBytesToWrite=0x16b30, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x4271a48*, lpNumberOfBytesWritten=0x138e77c*=0x16b30, lpOverlapped=0x0) returned 1 [0061.913] CloseHandle (hObject=0x2e4) returned 1 [0061.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3", lpFilePart=0x0) returned 0x36 [0061.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3.a", lpFilePart=0x0) returned 0x38 [0061.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0061.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\yordyp-.mp3"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b15670, ftCreationTime.dwHighDateTime=0x1d5eb67, ftLastAccessTime.dwLowDateTime=0x58a60380, ftLastAccessTime.dwHighDateTime=0x1d5e363, ftLastWriteTime.dwLowDateTime=0xd5d97d95, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x16b30)) returned 1 [0061.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0061.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\yordyp-.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\NY3gnwFowUC_DF_fGyRg\\yoRDyP-.mp3.a" (normalized: "c:\\users\\fd1hvy\\music\\ny3gnwfowuc_df_fgyrg\\yordyp-.mp3.a")) returned 1 [0061.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0061.917] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcf8 [0061.917] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.917] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.917] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.917] FindClose (in: hFindFile=0x169dcf8 | out: hFindFile=0x169dcf8) returned 1 [0061.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0061.918] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0061.918] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.918] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.918] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.918] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0061.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0061.919] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0061.919] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.919] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.919] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0061.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0061.919] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0061.920] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.920] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.920] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.920] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0061.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0061.920] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0061.920] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.921] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0061.921] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.921] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0061.921] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0061.921] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0061.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0061.921] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d878 [0061.922] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.922] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0061.922] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.922] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0061.922] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.922] FindClose (in: hFindFile=0x169d878 | out: hFindFile=0x169d878) returned 1 [0061.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0061.923] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0061.923] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.923] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.923] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.923] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0061.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0061.923] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0061.923] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc38 [0061.924] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.924] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.924] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0061.924] FindClose (in: hFindFile=0x169dc38 | out: hFindFile=0x169dc38) returned 1 [0061.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0061.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0061.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0061.924] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d7b8 [0061.924] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.925] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.925] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0061.925] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0061.925] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0061.925] FindNextFileW (in: hFindFile=0x169d7b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.925] FindClose (in: hFindFile=0x169d7b8 | out: hFindFile=0x169d7b8) returned 1 [0061.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0061.925] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d9b8 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0061.926] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0061.926] FindClose (in: hFindFile=0x169d9b8 | out: hFindFile=0x169d9b8) returned 1 [0061.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0061.927] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe51b1a26, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe51b1a26, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d9b8 [0061.927] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe51b1a26, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe51b1a26, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.927] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.927] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d77e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x86965db0, ftLastAccessTime.dwHighDateTime=0x1d5e275, ftLastWriteTime.dwLowDateTime=0x86965db0, ftLastWriteTime.dwHighDateTime=0x1d5e275, nFileSizeHigh=0x0, nFileSizeLow=0x8be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZvrmECq0VOUKjjTh.avi", cAlternateFileName="IDZVRM~1.AVI")) returned 1 [0061.927] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lf4sRlkHb9", cAlternateFileName="LF4SRL~1")) returned 1 [0061.927] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5556c720, ftCreationTime.dwHighDateTime=0x1d5e163, ftLastAccessTime.dwLowDateTime=0xb5c06920, ftLastAccessTime.dwHighDateTime=0x1d5e4e4, ftLastWriteTime.dwLowDateTime=0xb5c06920, ftLastWriteTime.dwHighDateTime=0x1d5e4e4, nFileSizeHigh=0x0, nFileSizeLow=0xcc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3tuExCypRmBis PD.mkv", cAlternateFileName="M3TUEX~1.MKV")) returned 1 [0061.928] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca6c970, ftCreationTime.dwHighDateTime=0x1d5e747, ftLastAccessTime.dwLowDateTime=0xe2c6c370, ftLastAccessTime.dwHighDateTime=0x1d5ea83, ftLastWriteTime.dwLowDateTime=0xe2c6c370, ftLastWriteTime.dwHighDateTime=0x1d5ea83, nFileSizeHigh=0x0, nFileSizeLow=0xf95, dwReserved0=0x0, dwReserved1=0x0, cFileName="puCwv.mp4", cAlternateFileName="")) returned 1 [0061.928] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sJ-bgujrBCwZVZv", cAlternateFileName="SJ-BGU~1")) returned 1 [0061.928] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b3190, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x85ca5220, ftLastAccessTime.dwHighDateTime=0x1d5e2d8, ftLastWriteTime.dwLowDateTime=0x85ca5220, ftLastWriteTime.dwHighDateTime=0x1d5e2d8, nFileSizeHigh=0x0, nFileSizeLow=0x10da6, dwReserved0=0x0, dwReserved1=0x0, cFileName="_9MqPeo.mkv", cAlternateFileName="")) returned 1 [0061.928] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.928] FindClose (in: hFindFile=0x169d9b8 | out: hFindFile=0x169d9b8) returned 1 [0061.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8a8) returned 1 [0061.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x105, lpBuffer=0x138e35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0061.928] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x138e5d0 | out: lpFindFileData=0x138e5d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe51b1a26, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe51b1a26, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc38 [0061.928] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe51b1a26, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe51b1a26, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d77e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x86965db0, ftLastAccessTime.dwHighDateTime=0x1d5e275, ftLastWriteTime.dwLowDateTime=0x86965db0, ftLastWriteTime.dwHighDateTime=0x1d5e275, nFileSizeHigh=0x0, nFileSizeLow=0x8be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="iDZvrmECq0VOUKjjTh.avi", cAlternateFileName="IDZVRM~1.AVI")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lf4sRlkHb9", cAlternateFileName="LF4SRL~1")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5556c720, ftCreationTime.dwHighDateTime=0x1d5e163, ftLastAccessTime.dwLowDateTime=0xb5c06920, ftLastAccessTime.dwHighDateTime=0x1d5e4e4, ftLastWriteTime.dwLowDateTime=0xb5c06920, ftLastWriteTime.dwHighDateTime=0x1d5e4e4, nFileSizeHigh=0x0, nFileSizeLow=0xcc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3tuExCypRmBis PD.mkv", cAlternateFileName="M3TUEX~1.MKV")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca6c970, ftCreationTime.dwHighDateTime=0x1d5e747, ftLastAccessTime.dwLowDateTime=0xe2c6c370, ftLastAccessTime.dwHighDateTime=0x1d5ea83, ftLastWriteTime.dwLowDateTime=0xe2c6c370, ftLastWriteTime.dwHighDateTime=0x1d5ea83, nFileSizeHigh=0x0, nFileSizeLow=0xf95, dwReserved0=0x0, dwReserved1=0x0, cFileName="puCwv.mp4", cAlternateFileName="")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sJ-bgujrBCwZVZv", cAlternateFileName="SJ-BGU~1")) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b3190, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x85ca5220, ftLastAccessTime.dwHighDateTime=0x1d5e2d8, ftLastWriteTime.dwLowDateTime=0x85ca5220, ftLastWriteTime.dwHighDateTime=0x1d5e2d8, nFileSizeHigh=0x0, nFileSizeLow=0x10da6, dwReserved0=0x0, dwReserved1=0x0, cFileName="_9MqPeo.mkv", cAlternateFileName="")) returned 1 [0061.930] FindNextFileW (in: hFindFile=0x169dc38, lpFindFileData=0x138e5dc | out: lpFindFileData=0x138e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b3190, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x85ca5220, ftLastAccessTime.dwHighDateTime=0x1d5e2d8, ftLastWriteTime.dwLowDateTime=0x85ca5220, ftLastWriteTime.dwHighDateTime=0x1d5e2d8, nFileSizeHigh=0x0, nFileSizeLow=0x10da6, dwReserved0=0x0, dwReserved1=0x0, cFileName="_9MqPeo.mkv", cAlternateFileName="")) returned 0 [0061.930] FindClose (in: hFindFile=0x169dc38 | out: hFindFile=0x169dc38) returned 1 [0061.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e864) returned 1 [0061.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e870) returned 1 [0061.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", lpFilePart=0x0) returned 0x2d [0061.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0061.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\idzvrmecq0voukjjth.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0061.930] GetFileType (hFile=0x2e4) returned 0x1 [0061.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0061.930] GetFileType (hFile=0x2e4) returned 0x1 [0061.930] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x8be9 [0061.930] ReadFile (in: hFile=0x2e4, lpBuffer=0x32838dc, nNumberOfBytesToRead=0x8be9, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x32838dc*, lpNumberOfBytesRead=0x138e7fc*=0x8be9, lpOverlapped=0x0) returned 1 [0061.931] CloseHandle (hObject=0x2e4) returned 1 [0062.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0062.030] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0062.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", lpFilePart=0x0) returned 0x2d [0062.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0062.030] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\idzvrmecq0voukjjth.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.031] GetFileType (hFile=0x2e4) returned 0x1 [0062.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0062.031] GetFileType (hFile=0x2e4) returned 0x1 [0062.031] WriteFile (in: hFile=0x2e4, lpBuffer=0x32fc3d4*, nNumberOfBytesToWrite=0x8bf0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x32fc3d4*, lpNumberOfBytesWritten=0x138e7f0*=0x8bf0, lpOverlapped=0x0) returned 1 [0062.032] CloseHandle (hObject=0x2e4) returned 1 [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi", lpFilePart=0x0) returned 0x2d [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi.a", lpFilePart=0x0) returned 0x2f [0062.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0062.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\idzvrmecq0voukjjth.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d77e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x86965db0, ftLastAccessTime.dwHighDateTime=0x1d5e275, ftLastWriteTime.dwLowDateTime=0xd5ec9379, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x8bf0)) returned 1 [0062.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0062.034] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\idzvrmecq0voukjjth.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\iDZvrmECq0VOUKjjTh.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\idzvrmecq0voukjjth.avi.a")) returned 1 [0062.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", lpFilePart=0x0) returned 0x2c [0062.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\m3tuexcyprmbis pd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.039] GetFileType (hFile=0x2e4) returned 0x1 [0062.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.039] GetFileType (hFile=0x2e4) returned 0x1 [0062.039] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xcc6 [0062.039] ReadFile (in: hFile=0x2e4, lpBuffer=0x33060f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33060f0*, lpNumberOfBytesRead=0x138e7fc*=0xcc6, lpOverlapped=0x0) returned 1 [0062.039] CloseHandle (hObject=0x2e4) returned 1 [0062.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0062.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0062.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", lpFilePart=0x0) returned 0x2c [0062.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0062.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\m3tuexcyprmbis pd.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.103] GetFileType (hFile=0x2e4) returned 0x1 [0062.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0062.103] GetFileType (hFile=0x2e4) returned 0x1 [0062.103] WriteFile (in: hFile=0x2e4, lpBuffer=0x33580f4*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x33580f4*, lpNumberOfBytesWritten=0x138e7c4*=0xcd0, lpOverlapped=0x0) returned 1 [0062.104] CloseHandle (hObject=0x2e4) returned 1 [0062.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv", lpFilePart=0x0) returned 0x2c [0062.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv.a", lpFilePart=0x0) returned 0x2e [0062.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0062.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\m3tuexcyprmbis pd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5556c720, ftCreationTime.dwHighDateTime=0x1d5e163, ftLastAccessTime.dwLowDateTime=0xb5c06920, ftLastAccessTime.dwHighDateTime=0x1d5e4e4, ftLastWriteTime.dwLowDateTime=0xd5f6197f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xcd0)) returned 1 [0062.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0062.105] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\m3tuexcyprmbis pd.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\m3tuExCypRmBis PD.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\m3tuexcyprmbis pd.mkv.a")) returned 1 [0062.106] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", lpFilePart=0x0) returned 0x20 [0062.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pucwv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.106] GetFileType (hFile=0x2e4) returned 0x1 [0062.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.114] GetFileType (hFile=0x2e4) returned 0x1 [0062.114] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0xf95 [0062.114] ReadFile (in: hFile=0x2e4, lpBuffer=0x335a2c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x335a2c8*, lpNumberOfBytesRead=0x138e7fc*=0xf95, lpOverlapped=0x0) returned 1 [0062.114] CloseHandle (hObject=0x2e4) returned 1 [0062.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0062.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0062.129] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", lpFilePart=0x0) returned 0x20 [0062.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0062.129] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pucwv.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.130] GetFileType (hFile=0x2e4) returned 0x1 [0062.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0062.130] GetFileType (hFile=0x2e4) returned 0x1 [0062.130] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ad0ac*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x138e7c4, lpOverlapped=0x0 | out: lpBuffer=0x33ad0ac*, lpNumberOfBytesWritten=0x138e7c4*=0xfa0, lpOverlapped=0x0) returned 1 [0062.131] CloseHandle (hObject=0x2e4) returned 1 [0062.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4", lpFilePart=0x0) returned 0x20 [0062.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4.a", lpFilePart=0x0) returned 0x22 [0062.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0062.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pucwv.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdca6c970, ftCreationTime.dwHighDateTime=0x1d5e747, ftLastAccessTime.dwLowDateTime=0xe2c6c370, ftLastAccessTime.dwHighDateTime=0x1d5ea83, ftLastWriteTime.dwLowDateTime=0xd5fadf02, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xfa0)) returned 1 [0062.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0062.132] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pucwv.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\puCwv.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\pucwv.mp4.a")) returned 1 [0062.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", nBufferLength=0x105, lpBuffer=0x138e210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", lpFilePart=0x0) returned 0x22 [0062.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.133] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_9mqpeo.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.133] GetFileType (hFile=0x2e4) returned 0x1 [0062.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.133] GetFileType (hFile=0x2e4) returned 0x1 [0062.133] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e850 | out: lpFileSizeHigh=0x138e850*=0x0) returned 0x10da6 [0062.133] ReadFile (in: hFile=0x2e4, lpBuffer=0x33ae29c, nNumberOfBytesToRead=0x10da6, lpNumberOfBytesRead=0x138e7fc, lpOverlapped=0x0 | out: lpBuffer=0x33ae29c*, lpNumberOfBytesRead=0x138e7fc*=0x10da6, lpOverlapped=0x0) returned 1 [0062.134] CloseHandle (hObject=0x2e4) returned 1 [0062.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c8) returned 1 [0062.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e844 | out: lpFileInformation=0x138e844*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7c4) returned 1 [0062.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", nBufferLength=0x105, lpBuffer=0x138e1fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", lpFilePart=0x0) returned 0x22 [0062.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e740) returned 1 [0062.198] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_9mqpeo.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.199] GetFileType (hFile=0x2e4) returned 0x1 [0062.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e73c) returned 1 [0062.200] GetFileType (hFile=0x2e4) returned 0x1 [0062.200] WriteFile (in: hFile=0x2e4, lpBuffer=0x342d9ac*, nNumberOfBytesToWrite=0x10db0, lpNumberOfBytesWritten=0x138e7f0, lpOverlapped=0x0 | out: lpBuffer=0x342d9ac*, lpNumberOfBytesWritten=0x138e7f0*=0x10db0, lpOverlapped=0x0) returned 1 [0062.202] CloseHandle (hObject=0x2e4) returned 1 [0062.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv", lpFilePart=0x0) returned 0x22 [0062.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv.a", nBufferLength=0x105, lpBuffer=0x138e320, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv.a", lpFilePart=0x0) returned 0x24 [0062.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7d4) returned 1 [0062.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_9mqpeo.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e850 | out: lpFileInformation=0x138e850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84b3190, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x85ca5220, ftLastAccessTime.dwHighDateTime=0x1d5e2d8, ftLastWriteTime.dwLowDateTime=0xd606ca4a, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x10db0)) returned 1 [0062.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7d0) returned 1 [0062.204] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\_9mqpeo.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_9MqPeo.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\_9mqpeo.mkv.a")) returned 1 [0062.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0062.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9", lpFilePart=0x0) returned 0x21 [0062.205] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b4bsILU0XLzUeXX", cAlternateFileName="9B4BSI~1")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5508d160, ftCreationTime.dwHighDateTime=0x1d5e3d8, ftLastAccessTime.dwLowDateTime=0x67bf99a0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x67bf99a0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0x1308f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA-h8L1uL cS04VyO.swf", cAlternateFileName="AA-H8L~1.SWF")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hEWR_paHyCJ", cAlternateFileName="HEWR_P~1")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e6120, ftCreationTime.dwHighDateTime=0x1d5ec6b, ftLastAccessTime.dwLowDateTime=0x5d57ef20, ftLastAccessTime.dwHighDateTime=0x1d5ebf0, ftLastWriteTime.dwLowDateTime=0x5d57ef20, ftLastWriteTime.dwHighDateTime=0x1d5ebf0, nFileSizeHigh=0x0, nFileSizeLow=0xd491, dwReserved0=0x0, dwReserved1=0x0, cFileName="J4nxTnlP0.mp4", cAlternateFileName="J4NXTN~1.MP4")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4YWOx0eAwxMX__rnRG", cAlternateFileName="K4YWOX~1")) returned 1 [0062.205] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe038fc40, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0x44e97930, ftLastAccessTime.dwHighDateTime=0x1d5eb6a, ftLastWriteTime.dwLowDateTime=0x44e97930, ftLastWriteTime.dwHighDateTime=0x1d5eb6a, nFileSizeHigh=0x0, nFileSizeLow=0xdaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kk1g5NzXQdP.avi", cAlternateFileName="KK1G5N~1.AVI")) returned 1 [0062.206] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6147ae70, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0xf92f9140, ftLastAccessTime.dwHighDateTime=0x1d5e3a9, ftLastWriteTime.dwLowDateTime=0xf92f9140, ftLastWriteTime.dwHighDateTime=0x1d5e3a9, nFileSizeHigh=0x0, nFileSizeLow=0xae7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QBUv4nmmf.swf", cAlternateFileName="QBUV4N~1.SWF")) returned 1 [0062.206] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d91a250, ftCreationTime.dwHighDateTime=0x1d5ee24, ftLastAccessTime.dwLowDateTime=0xa7e52d90, ftLastAccessTime.dwHighDateTime=0x1d5e2ff, ftLastWriteTime.dwLowDateTime=0xa7e52d90, ftLastWriteTime.dwHighDateTime=0x1d5e2ff, nFileSizeHigh=0x0, nFileSizeLow=0x3828, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcVxaaKHZomYrCV419.avi", cAlternateFileName="VCVXAA~1.AVI")) returned 1 [0062.206] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.206] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0062.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0062.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0062.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0062.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9", lpFilePart=0x0) returned 0x21 [0062.206] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d878 [0062.206] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bf2db90, ftCreationTime.dwHighDateTime=0x1d5e1ca, ftLastAccessTime.dwLowDateTime=0x8b774440, ftLastAccessTime.dwHighDateTime=0x1d5e7af, ftLastWriteTime.dwLowDateTime=0x8b774440, ftLastWriteTime.dwHighDateTime=0x1d5e7af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.206] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9b4bsILU0XLzUeXX", cAlternateFileName="9B4BSI~1")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5508d160, ftCreationTime.dwHighDateTime=0x1d5e3d8, ftLastAccessTime.dwLowDateTime=0x67bf99a0, ftLastAccessTime.dwHighDateTime=0x1d5e744, ftLastWriteTime.dwLowDateTime=0x67bf99a0, ftLastWriteTime.dwHighDateTime=0x1d5e744, nFileSizeHigh=0x0, nFileSizeLow=0x1308f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA-h8L1uL cS04VyO.swf", cAlternateFileName="AA-H8L~1.SWF")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hEWR_paHyCJ", cAlternateFileName="HEWR_P~1")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e6120, ftCreationTime.dwHighDateTime=0x1d5ec6b, ftLastAccessTime.dwLowDateTime=0x5d57ef20, ftLastAccessTime.dwHighDateTime=0x1d5ebf0, ftLastWriteTime.dwLowDateTime=0x5d57ef20, ftLastWriteTime.dwHighDateTime=0x1d5ebf0, nFileSizeHigh=0x0, nFileSizeLow=0xd491, dwReserved0=0x0, dwReserved1=0x0, cFileName="J4nxTnlP0.mp4", cAlternateFileName="J4NXTN~1.MP4")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4YWOx0eAwxMX__rnRG", cAlternateFileName="K4YWOX~1")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe038fc40, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0x44e97930, ftLastAccessTime.dwHighDateTime=0x1d5eb6a, ftLastWriteTime.dwLowDateTime=0x44e97930, ftLastWriteTime.dwHighDateTime=0x1d5eb6a, nFileSizeHigh=0x0, nFileSizeLow=0xdaf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kk1g5NzXQdP.avi", cAlternateFileName="KK1G5N~1.AVI")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6147ae70, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0xf92f9140, ftLastAccessTime.dwHighDateTime=0x1d5e3a9, ftLastWriteTime.dwLowDateTime=0xf92f9140, ftLastWriteTime.dwHighDateTime=0x1d5e3a9, nFileSizeHigh=0x0, nFileSizeLow=0xae7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="QBUv4nmmf.swf", cAlternateFileName="QBUV4N~1.SWF")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d91a250, ftCreationTime.dwHighDateTime=0x1d5ee24, ftLastAccessTime.dwLowDateTime=0xa7e52d90, ftLastAccessTime.dwHighDateTime=0x1d5e2ff, ftLastWriteTime.dwLowDateTime=0xa7e52d90, ftLastWriteTime.dwHighDateTime=0x1d5e2ff, nFileSizeHigh=0x0, nFileSizeLow=0x3828, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcVxaaKHZomYrCV419.avi", cAlternateFileName="VCVXAA~1.AVI")) returned 1 [0062.207] FindNextFileW (in: hFindFile=0x169d878, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d91a250, ftCreationTime.dwHighDateTime=0x1d5ee24, ftLastAccessTime.dwLowDateTime=0xa7e52d90, ftLastAccessTime.dwHighDateTime=0x1d5e2ff, ftLastWriteTime.dwLowDateTime=0xa7e52d90, ftLastWriteTime.dwHighDateTime=0x1d5e2ff, nFileSizeHigh=0x0, nFileSizeLow=0x3828, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcVxaaKHZomYrCV419.avi", cAlternateFileName="VCVXAA~1.AVI")) returned 0 [0062.207] FindClose (in: hFindFile=0x169d878 | out: hFindFile=0x169d878) returned 1 [0062.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0062.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0062.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", lpFilePart=0x0) returned 0x2f [0062.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.208] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\j4nxtnlp0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.208] GetFileType (hFile=0x2e4) returned 0x1 [0062.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.208] GetFileType (hFile=0x2e4) returned 0x1 [0062.208] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xd491 [0062.208] ReadFile (in: hFile=0x2e4, lpBuffer=0x3440eac, nNumberOfBytesToRead=0xd491, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x3440eac*, lpNumberOfBytesRead=0x138e788*=0xd491, lpOverlapped=0x0) returned 1 [0062.208] CloseHandle (hObject=0x2e4) returned 1 [0062.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", lpFilePart=0x0) returned 0x2f [0062.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0062.299] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\j4nxtnlp0.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.300] GetFileType (hFile=0x2e4) returned 0x1 [0062.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0062.300] GetFileType (hFile=0x2e4) returned 0x1 [0062.300] WriteFile (in: hFile=0x2e4, lpBuffer=0x32c3e58*, nNumberOfBytesToWrite=0xd4a0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x32c3e58*, lpNumberOfBytesWritten=0x138e77c*=0xd4a0, lpOverlapped=0x0) returned 1 [0062.302] CloseHandle (hObject=0x2e4) returned 1 [0062.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4", lpFilePart=0x0) returned 0x2f [0062.303] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4.a", lpFilePart=0x0) returned 0x31 [0062.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0062.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\j4nxtnlp0.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e6120, ftCreationTime.dwHighDateTime=0x1d5ec6b, ftLastAccessTime.dwLowDateTime=0x5d57ef20, ftLastAccessTime.dwHighDateTime=0x1d5ebf0, ftLastWriteTime.dwLowDateTime=0xd6151857, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xd4a0)) returned 1 [0062.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0062.304] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\j4nxtnlp0.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\J4nxTnlP0.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\j4nxtnlp0.mp4.a")) returned 1 [0062.304] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", lpFilePart=0x0) returned 0x31 [0062.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\kk1g5nzxqdp.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.304] GetFileType (hFile=0x2e4) returned 0x1 [0062.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.304] GetFileType (hFile=0x2e4) returned 0x1 [0062.305] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0xdaf7 [0062.305] ReadFile (in: hFile=0x2e4, lpBuffer=0x32d1748, nNumberOfBytesToRead=0xdaf7, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x32d1748*, lpNumberOfBytesRead=0x138e788*=0xdaf7, lpOverlapped=0x0) returned 1 [0062.305] CloseHandle (hObject=0x2e4) returned 1 [0062.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.369] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", lpFilePart=0x0) returned 0x31 [0062.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0062.369] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\kk1g5nzxqdp.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.370] GetFileType (hFile=0x2e4) returned 0x1 [0062.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0062.370] GetFileType (hFile=0x2e4) returned 0x1 [0062.370] WriteFile (in: hFile=0x2e4, lpBuffer=0x33477a4*, nNumberOfBytesToWrite=0xdb00, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33477a4*, lpNumberOfBytesWritten=0x138e77c*=0xdb00, lpOverlapped=0x0) returned 1 [0062.372] CloseHandle (hObject=0x2e4) returned 1 [0062.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi", lpFilePart=0x0) returned 0x31 [0062.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi.a", lpFilePart=0x0) returned 0x33 [0062.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0062.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\kk1g5nzxqdp.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe038fc40, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0x44e97930, ftLastAccessTime.dwHighDateTime=0x1d5eb6a, ftLastWriteTime.dwLowDateTime=0xd6210448, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xdb00)) returned 1 [0062.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0062.374] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\kk1g5nzxqdp.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\Kk1g5NzXQdP.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\kk1g5nzxqdp.avi.a")) returned 1 [0062.374] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", lpFilePart=0x0) returned 0x38 [0062.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.375] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\vcvxaakhzomyrcv419.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.375] GetFileType (hFile=0x2e4) returned 0x1 [0062.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.375] GetFileType (hFile=0x2e4) returned 0x1 [0062.375] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x3828 [0062.375] ReadFile (in: hFile=0x2e4, lpBuffer=0x3355740, nNumberOfBytesToRead=0x3828, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x3355740*, lpNumberOfBytesRead=0x138e788*=0x3828, lpOverlapped=0x0) returned 1 [0062.375] CloseHandle (hObject=0x2e4) returned 1 [0062.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0062.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0062.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", lpFilePart=0x0) returned 0x38 [0062.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0062.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\vcvxaakhzomyrcv419.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.391] GetFileType (hFile=0x2e4) returned 0x1 [0062.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0062.391] GetFileType (hFile=0x2e4) returned 0x1 [0062.391] WriteFile (in: hFile=0x2e4, lpBuffer=0x33b3e18*, nNumberOfBytesToWrite=0x3830, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x33b3e18*, lpNumberOfBytesWritten=0x138e77c*=0x3830, lpOverlapped=0x0) returned 1 [0062.451] CloseHandle (hObject=0x2e4) returned 1 [0062.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi", lpFilePart=0x0) returned 0x38 [0062.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi.a", lpFilePart=0x0) returned 0x3a [0062.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0062.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\vcvxaakhzomyrcv419.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d91a250, ftCreationTime.dwHighDateTime=0x1d5ee24, ftLastAccessTime.dwLowDateTime=0xa7e52d90, ftLastAccessTime.dwHighDateTime=0x1d5e2ff, ftLastWriteTime.dwLowDateTime=0xd62cefe4, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x3830)) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0062.453] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\vcvxaakhzomyrcv419.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\vcVxaaKHZomYrCV419.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\vcvxaakhzomyrcv419.avi.a")) returned 1 [0062.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0062.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX", lpFilePart=0x0) returned 0x32 [0062.453] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d8b8 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef142c0, ftCreationTime.dwHighDateTime=0x1d5e13a, ftLastAccessTime.dwLowDateTime=0x59539760, ftLastAccessTime.dwHighDateTime=0x1d5e4bd, ftLastWriteTime.dwLowDateTime=0x59539760, ftLastWriteTime.dwHighDateTime=0x1d5e4bd, nFileSizeHigh=0x0, nFileSizeLow=0x11124, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T4n7jFsdiP.mkv", cAlternateFileName="4T4N7J~1.MKV")) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fef9860, ftCreationTime.dwHighDateTime=0x1d5eadc, ftLastAccessTime.dwLowDateTime=0x8cbb0010, ftLastAccessTime.dwHighDateTime=0x1d5efcc, ftLastWriteTime.dwLowDateTime=0x8cbb0010, ftLastWriteTime.dwHighDateTime=0x1d5efcc, nFileSizeHigh=0x0, nFileSizeLow=0x18dea, dwReserved0=0x0, dwReserved1=0x0, cFileName="uePUKqElPP4YAG.mp4", cAlternateFileName="UEPUKQ~1.MP4")) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1b3a80, ftCreationTime.dwHighDateTime=0x1d5e7af, ftLastAccessTime.dwLowDateTime=0x3f0b0b60, ftLastAccessTime.dwHighDateTime=0x1d5ec68, ftLastWriteTime.dwLowDateTime=0x3f0b0b60, ftLastWriteTime.dwHighDateTime=0x1d5ec68, nFileSizeHigh=0x0, nFileSizeLow=0x634f, dwReserved0=0x0, dwReserved1=0x0, cFileName="yCaR1P.swf", cAlternateFileName="")) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c0c1f0, ftCreationTime.dwHighDateTime=0x1d5e38e, ftLastAccessTime.dwLowDateTime=0xa71d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e46e, ftLastWriteTime.dwLowDateTime=0xa71d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e46e, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="zniMqYfkh-z.mp4", cAlternateFileName="ZNIMQY~1.MP4")) returned 1 [0062.454] FindNextFileW (in: hFindFile=0x169d8b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.455] FindClose (in: hFindFile=0x169d8b8 | out: hFindFile=0x169d8b8) returned 1 [0062.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0062.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0062.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0062.455] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX", lpFilePart=0x0) returned 0x32 [0062.455] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dc78 [0062.455] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aac2bc0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0xbd0ddab0, ftLastAccessTime.dwHighDateTime=0x1d5ecc2, ftLastWriteTime.dwLowDateTime=0xbd0ddab0, ftLastWriteTime.dwHighDateTime=0x1d5ecc2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.455] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef142c0, ftCreationTime.dwHighDateTime=0x1d5e13a, ftLastAccessTime.dwLowDateTime=0x59539760, ftLastAccessTime.dwHighDateTime=0x1d5e4bd, ftLastWriteTime.dwLowDateTime=0x59539760, ftLastWriteTime.dwHighDateTime=0x1d5e4bd, nFileSizeHigh=0x0, nFileSizeLow=0x11124, dwReserved0=0x0, dwReserved1=0x0, cFileName="4T4n7jFsdiP.mkv", cAlternateFileName="4T4N7J~1.MKV")) returned 1 [0062.455] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fef9860, ftCreationTime.dwHighDateTime=0x1d5eadc, ftLastAccessTime.dwLowDateTime=0x8cbb0010, ftLastAccessTime.dwHighDateTime=0x1d5efcc, ftLastWriteTime.dwLowDateTime=0x8cbb0010, ftLastWriteTime.dwHighDateTime=0x1d5efcc, nFileSizeHigh=0x0, nFileSizeLow=0x18dea, dwReserved0=0x0, dwReserved1=0x0, cFileName="uePUKqElPP4YAG.mp4", cAlternateFileName="UEPUKQ~1.MP4")) returned 1 [0062.455] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1b3a80, ftCreationTime.dwHighDateTime=0x1d5e7af, ftLastAccessTime.dwLowDateTime=0x3f0b0b60, ftLastAccessTime.dwHighDateTime=0x1d5ec68, ftLastWriteTime.dwLowDateTime=0x3f0b0b60, ftLastWriteTime.dwHighDateTime=0x1d5ec68, nFileSizeHigh=0x0, nFileSizeLow=0x634f, dwReserved0=0x0, dwReserved1=0x0, cFileName="yCaR1P.swf", cAlternateFileName="")) returned 1 [0062.456] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c0c1f0, ftCreationTime.dwHighDateTime=0x1d5e38e, ftLastAccessTime.dwLowDateTime=0xa71d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e46e, ftLastWriteTime.dwLowDateTime=0xa71d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e46e, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="zniMqYfkh-z.mp4", cAlternateFileName="ZNIMQY~1.MP4")) returned 1 [0062.456] FindNextFileW (in: hFindFile=0x169dc78, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c0c1f0, ftCreationTime.dwHighDateTime=0x1d5e38e, ftLastAccessTime.dwLowDateTime=0xa71d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e46e, ftLastWriteTime.dwLowDateTime=0xa71d2be0, ftLastWriteTime.dwHighDateTime=0x1d5e46e, nFileSizeHigh=0x0, nFileSizeLow=0xc77, dwReserved0=0x0, dwReserved1=0x0, cFileName="zniMqYfkh-z.mp4", cAlternateFileName="ZNIMQY~1.MP4")) returned 0 [0062.456] FindClose (in: hFindFile=0x169dc78 | out: hFindFile=0x169dc78) returned 1 [0062.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0062.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0062.456] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", lpFilePart=0x0) returned 0x42 [0062.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\4t4n7jfsdip.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.456] GetFileType (hFile=0x2e4) returned 0x1 [0062.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.456] GetFileType (hFile=0x2e4) returned 0x1 [0062.456] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x11124 [0062.456] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b9754, nNumberOfBytesToRead=0x11124, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33b9754*, lpNumberOfBytesRead=0x138e714*=0x11124, lpOverlapped=0x0) returned 1 [0062.457] CloseHandle (hObject=0x2e4) returned 1 [0062.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", lpFilePart=0x0) returned 0x42 [0062.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0062.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\4t4n7jfsdip.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.475] GetFileType (hFile=0x2e4) returned 0x1 [0062.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0062.475] GetFileType (hFile=0x2e4) returned 0x1 [0062.475] WriteFile (in: hFile=0x2e4, lpBuffer=0x34398e0*, nNumberOfBytesToWrite=0x11130, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x34398e0*, lpNumberOfBytesWritten=0x138e708*=0x11130, lpOverlapped=0x0) returned 1 [0062.476] CloseHandle (hObject=0x2e4) returned 1 [0062.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv", lpFilePart=0x0) returned 0x42 [0062.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv.a", lpFilePart=0x0) returned 0x44 [0062.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0062.479] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\4t4n7jfsdip.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef142c0, ftCreationTime.dwHighDateTime=0x1d5e13a, ftLastAccessTime.dwLowDateTime=0x59539760, ftLastAccessTime.dwHighDateTime=0x1d5e4bd, ftLastWriteTime.dwLowDateTime=0xd62f5366, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x11130)) returned 1 [0062.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0062.479] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\4t4n7jfsdip.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\4T4n7jFsdiP.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\4t4n7jfsdip.mkv.a")) returned 1 [0062.479] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", lpFilePart=0x0) returned 0x45 [0062.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\uepukqelpp4yag.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.479] GetFileType (hFile=0x2e4) returned 0x1 [0062.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.479] GetFileType (hFile=0x2e4) returned 0x1 [0062.479] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x18dea [0062.480] ReadFile (in: hFile=0x2e4, lpBuffer=0x42b8950, nNumberOfBytesToRead=0x18dea, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x42b8950*, lpNumberOfBytesRead=0x138e714*=0x18dea, lpOverlapped=0x0) returned 1 [0062.480] CloseHandle (hObject=0x2e4) returned 1 [0062.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", lpFilePart=0x0) returned 0x45 [0062.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0062.622] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\uepukqelpp4yag.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.624] GetFileType (hFile=0x2e4) returned 0x1 [0062.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0062.624] GetFileType (hFile=0x2e4) returned 0x1 [0062.624] WriteFile (in: hFile=0x2e4, lpBuffer=0x4334f38*, nNumberOfBytesToWrite=0x18df0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x4334f38*, lpNumberOfBytesWritten=0x138e708*=0x18df0, lpOverlapped=0x0) returned 1 [0062.626] CloseHandle (hObject=0x2e4) returned 1 [0062.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4", lpFilePart=0x0) returned 0x45 [0062.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4.a", lpFilePart=0x0) returned 0x47 [0062.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0062.629] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\uepukqelpp4yag.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fef9860, ftCreationTime.dwHighDateTime=0x1d5eadc, ftLastAccessTime.dwLowDateTime=0x8cbb0010, ftLastAccessTime.dwHighDateTime=0x1d5efcc, ftLastWriteTime.dwLowDateTime=0xd64729db, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x18df0)) returned 1 [0062.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0062.629] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\uepukqelpp4yag.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\uePUKqElPP4YAG.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\uepukqelpp4yag.mp4.a")) returned 1 [0062.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", lpFilePart=0x0) returned 0x42 [0062.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\znimqyfkh-z.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.629] GetFileType (hFile=0x2e4) returned 0x1 [0062.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.630] GetFileType (hFile=0x2e4) returned 0x1 [0062.630] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xc77 [0062.630] ReadFile (in: hFile=0x2e4, lpBuffer=0x329995c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x329995c*, lpNumberOfBytesRead=0x138e714*=0xc77, lpOverlapped=0x0) returned 1 [0062.630] CloseHandle (hObject=0x2e4) returned 1 [0062.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", lpFilePart=0x0) returned 0x42 [0062.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0062.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\znimqyfkh-z.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.694] GetFileType (hFile=0x2e4) returned 0x1 [0062.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0062.694] GetFileType (hFile=0x2e4) returned 0x1 [0062.694] WriteFile (in: hFile=0x2e4, lpBuffer=0x32eb94c*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x138e6dc, lpOverlapped=0x0 | out: lpBuffer=0x32eb94c*, lpNumberOfBytesWritten=0x138e6dc*=0xc80, lpOverlapped=0x0) returned 1 [0062.695] CloseHandle (hObject=0x2e4) returned 1 [0062.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4", lpFilePart=0x0) returned 0x42 [0062.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4.a", lpFilePart=0x0) returned 0x44 [0062.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0062.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\znimqyfkh-z.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c0c1f0, ftCreationTime.dwHighDateTime=0x1d5e38e, ftLastAccessTime.dwLowDateTime=0xa71d2be0, ftLastAccessTime.dwHighDateTime=0x1d5e46e, ftLastWriteTime.dwLowDateTime=0xd650b2fe, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc80)) returned 1 [0062.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0062.696] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\znimqyfkh-z.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\9b4bsILU0XLzUeXX\\zniMqYfkh-z.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\9b4bsilu0xlzuexx\\znimqyfkh-z.mp4.a")) returned 1 [0062.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0062.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ", lpFilePart=0x0) returned 0x2d [0062.697] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169daf8 [0062.697] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297459c0, ftCreationTime.dwHighDateTime=0x1d5ef54, ftLastAccessTime.dwLowDateTime=0x6e59b9b0, ftLastAccessTime.dwHighDateTime=0x1d5eb51, ftLastWriteTime.dwLowDateTime=0x6e59b9b0, ftLastWriteTime.dwHighDateTime=0x1d5eb51, nFileSizeHigh=0x0, nFileSizeLow=0x18cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5B0OevfcNRt.flv", cAlternateFileName="G5B0OE~1.FLV")) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd4a200, ftCreationTime.dwHighDateTime=0x1d5e326, ftLastAccessTime.dwLowDateTime=0x71b433a0, ftLastAccessTime.dwHighDateTime=0x1d5f115, ftLastWriteTime.dwLowDateTime=0x71b433a0, ftLastWriteTime.dwHighDateTime=0x1d5f115, nFileSizeHigh=0x0, nFileSizeLow=0x2bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gdWjs56QDzBS.swf", cAlternateFileName="GDWJS5~1.SWF")) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QEmWIgBHWIlal9PO", cAlternateFileName="QEMWIG~1")) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70447a0, ftCreationTime.dwHighDateTime=0x1d5e876, ftLastAccessTime.dwLowDateTime=0x84cf5460, ftLastAccessTime.dwHighDateTime=0x1d5ebac, ftLastWriteTime.dwLowDateTime=0x84cf5460, ftLastWriteTime.dwHighDateTime=0x1d5ebac, nFileSizeHigh=0x0, nFileSizeLow=0x5b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="snTy4YXrtwjoO.avi", cAlternateFileName="SNTY4Y~1.AVI")) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112bc0f0, ftCreationTime.dwHighDateTime=0x1d5e20d, ftLastAccessTime.dwLowDateTime=0x6021490, ftLastAccessTime.dwHighDateTime=0x1d5ea5f, ftLastWriteTime.dwLowDateTime=0x6021490, ftLastWriteTime.dwHighDateTime=0x1d5ea5f, nFileSizeHigh=0x0, nFileSizeLow=0x7d23, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA3z-kPU7C.avi", cAlternateFileName="UA3Z-K~1.AVI")) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.698] FindClose (in: hFindFile=0x169daf8 | out: hFindFile=0x169daf8) returned 1 [0062.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0062.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0062.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0062.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ", lpFilePart=0x0) returned 0x2d [0062.698] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dcf8 [0062.698] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91db2a60, ftCreationTime.dwHighDateTime=0x1d5ebc2, ftLastAccessTime.dwLowDateTime=0x526d5d20, ftLastAccessTime.dwHighDateTime=0x1d5ea06, ftLastWriteTime.dwLowDateTime=0x526d5d20, ftLastWriteTime.dwHighDateTime=0x1d5ea06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297459c0, ftCreationTime.dwHighDateTime=0x1d5ef54, ftLastAccessTime.dwLowDateTime=0x6e59b9b0, ftLastAccessTime.dwHighDateTime=0x1d5eb51, ftLastWriteTime.dwLowDateTime=0x6e59b9b0, ftLastWriteTime.dwHighDateTime=0x1d5eb51, nFileSizeHigh=0x0, nFileSizeLow=0x18cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="g5B0OevfcNRt.flv", cAlternateFileName="G5B0OE~1.FLV")) returned 1 [0062.699] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bd4a200, ftCreationTime.dwHighDateTime=0x1d5e326, ftLastAccessTime.dwLowDateTime=0x71b433a0, ftLastAccessTime.dwHighDateTime=0x1d5f115, ftLastWriteTime.dwLowDateTime=0x71b433a0, ftLastWriteTime.dwHighDateTime=0x1d5f115, nFileSizeHigh=0x0, nFileSizeLow=0x2bf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gdWjs56QDzBS.swf", cAlternateFileName="GDWJS5~1.SWF")) returned 1 [0062.699] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QEmWIgBHWIlal9PO", cAlternateFileName="QEMWIG~1")) returned 1 [0062.699] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70447a0, ftCreationTime.dwHighDateTime=0x1d5e876, ftLastAccessTime.dwLowDateTime=0x84cf5460, ftLastAccessTime.dwHighDateTime=0x1d5ebac, ftLastWriteTime.dwLowDateTime=0x84cf5460, ftLastWriteTime.dwHighDateTime=0x1d5ebac, nFileSizeHigh=0x0, nFileSizeLow=0x5b3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="snTy4YXrtwjoO.avi", cAlternateFileName="SNTY4Y~1.AVI")) returned 1 [0062.699] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112bc0f0, ftCreationTime.dwHighDateTime=0x1d5e20d, ftLastAccessTime.dwLowDateTime=0x6021490, ftLastAccessTime.dwHighDateTime=0x1d5ea5f, ftLastWriteTime.dwLowDateTime=0x6021490, ftLastWriteTime.dwHighDateTime=0x1d5ea5f, nFileSizeHigh=0x0, nFileSizeLow=0x7d23, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA3z-kPU7C.avi", cAlternateFileName="UA3Z-K~1.AVI")) returned 1 [0062.699] FindNextFileW (in: hFindFile=0x169dcf8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112bc0f0, ftCreationTime.dwHighDateTime=0x1d5e20d, ftLastAccessTime.dwLowDateTime=0x6021490, ftLastAccessTime.dwHighDateTime=0x1d5ea5f, ftLastWriteTime.dwLowDateTime=0x6021490, ftLastWriteTime.dwHighDateTime=0x1d5ea5f, nFileSizeHigh=0x0, nFileSizeLow=0x7d23, dwReserved0=0x0, dwReserved1=0x0, cFileName="UA3z-kPU7C.avi", cAlternateFileName="UA3Z-K~1.AVI")) returned 0 [0062.699] FindClose (in: hFindFile=0x169dcf8 | out: hFindFile=0x169dcf8) returned 1 [0062.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0062.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0062.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", lpFilePart=0x0) returned 0x3f [0062.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\snty4yxrtwjoo.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.700] GetFileType (hFile=0x2e4) returned 0x1 [0062.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.700] GetFileType (hFile=0x2e4) returned 0x1 [0062.700] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x5b3c [0062.700] ReadFile (in: hFile=0x2e4, lpBuffer=0x32eeb04, nNumberOfBytesToRead=0x5b3c, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x32eeb04*, lpNumberOfBytesRead=0x138e714*=0x5b3c, lpOverlapped=0x0) returned 1 [0062.700] CloseHandle (hObject=0x2e4) returned 1 [0062.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", lpFilePart=0x0) returned 0x3f [0062.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0062.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\snty4yxrtwjoo.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.716] GetFileType (hFile=0x2e4) returned 0x1 [0062.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0062.717] GetFileType (hFile=0x2e4) returned 0x1 [0062.717] WriteFile (in: hFile=0x2e4, lpBuffer=0x335812c*, nNumberOfBytesToWrite=0x5b40, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x335812c*, lpNumberOfBytesWritten=0x138e708*=0x5b40, lpOverlapped=0x0) returned 1 [0062.718] CloseHandle (hObject=0x2e4) returned 1 [0062.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi", lpFilePart=0x0) returned 0x3f [0062.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi.a", lpFilePart=0x0) returned 0x41 [0062.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0062.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\snty4yxrtwjoo.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70447a0, ftCreationTime.dwHighDateTime=0x1d5e876, ftLastAccessTime.dwLowDateTime=0x84cf5460, ftLastAccessTime.dwHighDateTime=0x1d5ebac, ftLastWriteTime.dwLowDateTime=0xd655783f, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x5b40)) returned 1 [0062.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0062.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\snty4yxrtwjoo.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\snTy4YXrtwjoO.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\snty4yxrtwjoo.avi.a")) returned 1 [0062.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", lpFilePart=0x0) returned 0x3c [0062.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.720] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\ua3z-kpu7c.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.720] GetFileType (hFile=0x2e4) returned 0x1 [0062.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.720] GetFileType (hFile=0x2e4) returned 0x1 [0062.720] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x7d23 [0062.720] ReadFile (in: hFile=0x2e4, lpBuffer=0x335e15c, nNumberOfBytesToRead=0x7d23, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x335e15c*, lpNumberOfBytesRead=0x138e714*=0x7d23, lpOverlapped=0x0) returned 1 [0062.720] CloseHandle (hObject=0x2e4) returned 1 [0062.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0062.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0062.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", lpFilePart=0x0) returned 0x3c [0062.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0062.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\ua3z-kpu7c.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.785] GetFileType (hFile=0x2e4) returned 0x1 [0062.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0062.785] GetFileType (hFile=0x2e4) returned 0x1 [0062.785] WriteFile (in: hFile=0x2e4, lpBuffer=0x33d2138*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x33d2138*, lpNumberOfBytesWritten=0x138e708*=0x7d30, lpOverlapped=0x0) returned 1 [0062.787] CloseHandle (hObject=0x2e4) returned 1 [0062.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi", lpFilePart=0x0) returned 0x3c [0062.788] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi.a", lpFilePart=0x0) returned 0x3e [0062.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0062.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\ua3z-kpu7c.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112bc0f0, ftCreationTime.dwHighDateTime=0x1d5e20d, ftLastAccessTime.dwLowDateTime=0x6021490, ftLastAccessTime.dwHighDateTime=0x1d5ea5f, ftLastWriteTime.dwLowDateTime=0xd65eff01, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x7d30)) returned 1 [0062.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0062.788] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\ua3z-kpu7c.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\UA3z-kPU7C.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\ua3z-kpu7c.avi.a")) returned 1 [0062.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0062.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO", lpFilePart=0x0) returned 0x3e [0062.789] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d738 [0062.789] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.789] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ff3420, ftCreationTime.dwHighDateTime=0x1d5eeae, ftLastAccessTime.dwLowDateTime=0x65c12a30, ftLastAccessTime.dwHighDateTime=0x1d5ee9a, ftLastWriteTime.dwLowDateTime=0x65c12a30, ftLastWriteTime.dwHighDateTime=0x1d5ee9a, nFileSizeHigh=0x0, nFileSizeLow=0x3c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="L8iYGvYA_7Y.mkv", cAlternateFileName="L8IYGV~1.MKV")) returned 1 [0062.789] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cab72c0, ftCreationTime.dwHighDateTime=0x1d5e1a1, ftLastAccessTime.dwLowDateTime=0x976e9410, ftLastAccessTime.dwHighDateTime=0x1d5e764, ftLastWriteTime.dwLowDateTime=0x976e9410, ftLastWriteTime.dwHighDateTime=0x1d5e764, nFileSizeHigh=0x0, nFileSizeLow=0xc60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZfJ3crkp29NpXlV.avi", cAlternateFileName="MZFJ3C~1.AVI")) returned 1 [0062.790] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80738ee0, ftCreationTime.dwHighDateTime=0x1d5e88c, ftLastAccessTime.dwLowDateTime=0x16af11b0, ftLastAccessTime.dwHighDateTime=0x1d5e7fa, ftLastWriteTime.dwLowDateTime=0x16af11b0, ftLastWriteTime.dwHighDateTime=0x1d5e7fa, nFileSizeHigh=0x0, nFileSizeLow=0x71b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U-MxN15t0I.mkv", cAlternateFileName="U-MXN1~1.MKV")) returned 1 [0062.790] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27272b0, ftCreationTime.dwHighDateTime=0x1d5e92e, ftLastAccessTime.dwLowDateTime=0x97c31220, ftLastAccessTime.dwHighDateTime=0x1d5e4f2, ftLastWriteTime.dwLowDateTime=0x97c31220, ftLastWriteTime.dwHighDateTime=0x1d5e4f2, nFileSizeHigh=0x0, nFileSizeLow=0xa346, dwReserved0=0x0, dwReserved1=0x0, cFileName="uPoxBYnaB.avi", cAlternateFileName="UPOXBY~1.AVI")) returned 1 [0062.790] FindNextFileW (in: hFindFile=0x169d738, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0062.790] FindClose (in: hFindFile=0x169d738 | out: hFindFile=0x169d738) returned 1 [0062.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0062.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0062.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0062.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO", lpFilePart=0x0) returned 0x3e [0062.790] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169daf8 [0062.790] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x79a2c420, ftCreationTime.dwHighDateTime=0x1d5e16e, ftLastAccessTime.dwLowDateTime=0xf2590af0, ftLastAccessTime.dwHighDateTime=0x1d5e7e0, ftLastWriteTime.dwLowDateTime=0xf2590af0, ftLastWriteTime.dwHighDateTime=0x1d5e7e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.790] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ff3420, ftCreationTime.dwHighDateTime=0x1d5eeae, ftLastAccessTime.dwLowDateTime=0x65c12a30, ftLastAccessTime.dwHighDateTime=0x1d5ee9a, ftLastWriteTime.dwLowDateTime=0x65c12a30, ftLastWriteTime.dwHighDateTime=0x1d5ee9a, nFileSizeHigh=0x0, nFileSizeLow=0x3c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="L8iYGvYA_7Y.mkv", cAlternateFileName="L8IYGV~1.MKV")) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cab72c0, ftCreationTime.dwHighDateTime=0x1d5e1a1, ftLastAccessTime.dwLowDateTime=0x976e9410, ftLastAccessTime.dwHighDateTime=0x1d5e764, ftLastWriteTime.dwLowDateTime=0x976e9410, ftLastWriteTime.dwHighDateTime=0x1d5e764, nFileSizeHigh=0x0, nFileSizeLow=0xc60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZfJ3crkp29NpXlV.avi", cAlternateFileName="MZFJ3C~1.AVI")) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80738ee0, ftCreationTime.dwHighDateTime=0x1d5e88c, ftLastAccessTime.dwLowDateTime=0x16af11b0, ftLastAccessTime.dwHighDateTime=0x1d5e7fa, ftLastWriteTime.dwLowDateTime=0x16af11b0, ftLastWriteTime.dwHighDateTime=0x1d5e7fa, nFileSizeHigh=0x0, nFileSizeLow=0x71b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U-MxN15t0I.mkv", cAlternateFileName="U-MXN1~1.MKV")) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27272b0, ftCreationTime.dwHighDateTime=0x1d5e92e, ftLastAccessTime.dwLowDateTime=0x97c31220, ftLastAccessTime.dwHighDateTime=0x1d5e4f2, ftLastWriteTime.dwLowDateTime=0x97c31220, ftLastWriteTime.dwHighDateTime=0x1d5e4f2, nFileSizeHigh=0x0, nFileSizeLow=0xa346, dwReserved0=0x0, dwReserved1=0x0, cFileName="uPoxBYnaB.avi", cAlternateFileName="UPOXBY~1.AVI")) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x169daf8, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27272b0, ftCreationTime.dwHighDateTime=0x1d5e92e, ftLastAccessTime.dwLowDateTime=0x97c31220, ftLastAccessTime.dwHighDateTime=0x1d5e4f2, ftLastWriteTime.dwLowDateTime=0x97c31220, ftLastWriteTime.dwHighDateTime=0x1d5e4f2, nFileSizeHigh=0x0, nFileSizeLow=0xa346, dwReserved0=0x0, dwReserved1=0x0, cFileName="uPoxBYnaB.avi", cAlternateFileName="UPOXBY~1.AVI")) returned 0 [0062.791] FindClose (in: hFindFile=0x169daf8 | out: hFindFile=0x169daf8) returned 1 [0062.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0062.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0062.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", lpFilePart=0x0) returned 0x4e [0062.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0062.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\l8iygvya_7y.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.792] GetFileType (hFile=0x2e4) returned 0x1 [0062.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0062.792] GetFileType (hFile=0x2e4) returned 0x1 [0062.792] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x3c2e [0062.792] ReadFile (in: hFile=0x2e4, lpBuffer=0x33dc3a8, nNumberOfBytesToRead=0x3c2e, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x33dc3a8*, lpNumberOfBytesRead=0x138e6a0*=0x3c2e, lpOverlapped=0x0) returned 1 [0062.792] CloseHandle (hObject=0x2e4) returned 1 [0062.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", lpFilePart=0x0) returned 0x4e [0062.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0062.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\l8iygvya_7y.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.856] GetFileType (hFile=0x2e4) returned 0x1 [0062.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0062.856] GetFileType (hFile=0x2e4) returned 0x1 [0062.856] WriteFile (in: hFile=0x2e4, lpBuffer=0x343be84*, nNumberOfBytesToWrite=0x3c30, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x343be84*, lpNumberOfBytesWritten=0x138e694*=0x3c30, lpOverlapped=0x0) returned 1 [0062.857] CloseHandle (hObject=0x2e4) returned 1 [0062.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv", lpFilePart=0x0) returned 0x4e [0062.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv.a", lpFilePart=0x0) returned 0x50 [0062.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0062.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\l8iygvya_7y.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ff3420, ftCreationTime.dwHighDateTime=0x1d5eeae, ftLastAccessTime.dwLowDateTime=0x65c12a30, ftLastAccessTime.dwHighDateTime=0x1d5ee9a, ftLastWriteTime.dwLowDateTime=0xd66aeeef, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x3c30)) returned 1 [0062.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0062.859] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\l8iygvya_7y.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\L8iYGvYA_7Y.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\l8iygvya_7y.mkv.a")) returned 1 [0062.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", lpFilePart=0x0) returned 0x53 [0062.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0062.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\mzfj3crkp29npxlv.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.859] GetFileType (hFile=0x2e4) returned 0x1 [0062.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0062.859] GetFileType (hFile=0x2e4) returned 0x1 [0062.859] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0xc60b [0062.859] ReadFile (in: hFile=0x2e4, lpBuffer=0x3440058, nNumberOfBytesToRead=0xc60b, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x3440058*, lpNumberOfBytesRead=0x138e6a0*=0xc60b, lpOverlapped=0x0) returned 1 [0062.860] CloseHandle (hObject=0x2e4) returned 1 [0062.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0062.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0062.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0062.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0062.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", lpFilePart=0x0) returned 0x53 [0062.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0062.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\mzfj3crkp29npxlv.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.956] GetFileType (hFile=0x2e4) returned 0x1 [0062.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0062.956] GetFileType (hFile=0x2e4) returned 0x1 [0062.956] WriteFile (in: hFile=0x2e4, lpBuffer=0x32bf5a8*, nNumberOfBytesToWrite=0xc610, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x32bf5a8*, lpNumberOfBytesWritten=0x138e694*=0xc610, lpOverlapped=0x0) returned 1 [0062.958] CloseHandle (hObject=0x2e4) returned 1 [0062.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi", lpFilePart=0x0) returned 0x53 [0062.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi.a", lpFilePart=0x0) returned 0x55 [0062.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0062.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\mzfj3crkp29npxlv.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cab72c0, ftCreationTime.dwHighDateTime=0x1d5e1a1, ftLastAccessTime.dwLowDateTime=0x976e9410, ftLastAccessTime.dwHighDateTime=0x1d5e764, ftLastWriteTime.dwLowDateTime=0xd6793a84, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xc610)) returned 1 [0062.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0062.960] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\mzfj3crkp29npxlv.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\MZfJ3crkp29NpXlV.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\mzfj3crkp29npxlv.avi.a")) returned 1 [0062.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", lpFilePart=0x0) returned 0x4d [0062.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0062.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\u-mxn15t0i.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0062.961] GetFileType (hFile=0x2e4) returned 0x1 [0062.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0062.961] GetFileType (hFile=0x2e4) returned 0x1 [0062.961] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0x71b0 [0062.961] ReadFile (in: hFile=0x2e4, lpBuffer=0x32cc170, nNumberOfBytesToRead=0x71b0, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x32cc170*, lpNumberOfBytesRead=0x138e6a0*=0x71b0, lpOverlapped=0x0) returned 1 [0062.961] CloseHandle (hObject=0x2e4) returned 1 [0063.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.024] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", lpFilePart=0x0) returned 0x4d [0063.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0063.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\u-mxn15t0i.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.025] GetFileType (hFile=0x2e4) returned 0x1 [0063.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0063.025] GetFileType (hFile=0x2e4) returned 0x1 [0063.025] WriteFile (in: hFile=0x2e4, lpBuffer=0x333c974*, nNumberOfBytesToWrite=0x71c0, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x333c974*, lpNumberOfBytesWritten=0x138e694*=0x71c0, lpOverlapped=0x0) returned 1 [0063.026] CloseHandle (hObject=0x2e4) returned 1 [0063.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv", lpFilePart=0x0) returned 0x4d [0063.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv.a", lpFilePart=0x0) returned 0x4f [0063.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0063.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\u-mxn15t0i.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80738ee0, ftCreationTime.dwHighDateTime=0x1d5e88c, ftLastAccessTime.dwLowDateTime=0x16af11b0, ftLastAccessTime.dwHighDateTime=0x1d5e7fa, ftLastWriteTime.dwLowDateTime=0xd682c4fb, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x71c0)) returned 1 [0063.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0063.028] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\u-mxn15t0i.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\U-MxN15t0I.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\u-mxn15t0i.mkv.a")) returned 1 [0063.028] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", nBufferLength=0x105, lpBuffer=0x138e0b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", lpFilePart=0x0) returned 0x4c [0063.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5f8) returned 1 [0063.028] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\upoxbynab.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.028] GetFileType (hFile=0x2e4) returned 0x1 [0063.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5f4) returned 1 [0063.028] GetFileType (hFile=0x2e4) returned 0x1 [0063.028] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e6f4 | out: lpFileSizeHigh=0x138e6f4*=0x0) returned 0xa346 [0063.029] ReadFile (in: hFile=0x2e4, lpBuffer=0x33440ac, nNumberOfBytesToRead=0xa346, lpNumberOfBytesRead=0x138e6a0, lpOverlapped=0x0 | out: lpBuffer=0x33440ac*, lpNumberOfBytesRead=0x138e6a0*=0xa346, lpOverlapped=0x0) returned 1 [0063.029] CloseHandle (hObject=0x2e4) returned 1 [0063.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.044] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e6e8 | out: lpFileInformation=0x138e6e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", nBufferLength=0x105, lpBuffer=0x138e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", lpFilePart=0x0) returned 0x4c [0063.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e5e4) returned 1 [0063.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\upoxbynab.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.046] GetFileType (hFile=0x2e4) returned 0x1 [0063.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e5e0) returned 1 [0063.046] GetFileType (hFile=0x2e4) returned 0x1 [0063.046] WriteFile (in: hFile=0x2e4, lpBuffer=0x33c3f28*, nNumberOfBytesToWrite=0xa350, lpNumberOfBytesWritten=0x138e694, lpOverlapped=0x0 | out: lpBuffer=0x33c3f28*, lpNumberOfBytesWritten=0x138e694*=0xa350, lpOverlapped=0x0) returned 1 [0063.047] CloseHandle (hObject=0x2e4) returned 1 [0063.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi", lpFilePart=0x0) returned 0x4c [0063.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi.a", nBufferLength=0x105, lpBuffer=0x138e1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi.a", lpFilePart=0x0) returned 0x4e [0063.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e678) returned 1 [0063.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\upoxbynab.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e6f4 | out: lpFileInformation=0x138e6f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb27272b0, ftCreationTime.dwHighDateTime=0x1d5e92e, ftLastAccessTime.dwLowDateTime=0x97c31220, ftLastAccessTime.dwHighDateTime=0x1d5e4f2, ftLastWriteTime.dwLowDateTime=0xd68789e8, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xa350)) returned 1 [0063.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e674) returned 1 [0063.049] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\upoxbynab.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\hEWR_paHyCJ\\QEmWIgBHWIlal9PO\\uPoxBYnaB.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\hewr_pahycj\\qemwigbhwilal9po\\upoxbynab.avi.a")) returned 1 [0063.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0063.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG", lpFilePart=0x0) returned 0x35 [0063.049] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169d9b8 [0063.049] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe300d5c0, ftCreationTime.dwHighDateTime=0x1d5eee2, ftLastAccessTime.dwLowDateTime=0x7483e550, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0x7483e550, ftLastWriteTime.dwHighDateTime=0x1d5f0dc, nFileSizeHigh=0x0, nFileSizeLow=0x1443d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wDFs.avi", cAlternateFileName="")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa225910, ftCreationTime.dwHighDateTime=0x1d5ea62, ftLastAccessTime.dwLowDateTime=0x9fc1a030, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x9fc1a030, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x24f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7199yKnCUmoxD.mkv", cAlternateFileName="7199YK~1.MKV")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a70c30, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x926dfcb0, ftLastAccessTime.dwHighDateTime=0x1d5e6ad, ftLastWriteTime.dwLowDateTime=0x926dfcb0, ftLastWriteTime.dwHighDateTime=0x1d5e6ad, nFileSizeHigh=0x0, nFileSizeLow=0x30cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-nTnJ9ak4vtRGg.mp4", cAlternateFileName="D-NTNJ~1.MP4")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x999f2700, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0x653c4860, ftLastAccessTime.dwHighDateTime=0x1d5eb9d, ftLastWriteTime.dwLowDateTime=0x653c4860, ftLastWriteTime.dwHighDateTime=0x1d5eb9d, nFileSizeHigh=0x0, nFileSizeLow=0x726a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISzk2iJ0yWhJ4w.swf", cAlternateFileName="ISZK2I~1.SWF")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b6e60, ftCreationTime.dwHighDateTime=0x1d5eace, ftLastAccessTime.dwLowDateTime=0x80620fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee8c, ftLastWriteTime.dwLowDateTime=0x80620fc0, ftLastWriteTime.dwHighDateTime=0x1d5ee8c, nFileSizeHigh=0x0, nFileSizeLow=0x9e49, dwReserved0=0x0, dwReserved1=0x0, cFileName="QFMsez47.mkv", cAlternateFileName="")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U77k8xqMOibeFwZJOq", cAlternateFileName="U77K8X~1")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da64510, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0xd5361c0, ftLastAccessTime.dwHighDateTime=0x1d5f100, ftLastWriteTime.dwLowDateTime=0xd5361c0, ftLastWriteTime.dwHighDateTime=0x1d5f100, nFileSizeHigh=0x0, nFileSizeLow=0xe378, dwReserved0=0x0, dwReserved1=0x0, cFileName="vgS_5FELSSv3TXBfeX.mp4", cAlternateFileName="VGS_5F~1.MP4")) returned 1 [0063.050] FindNextFileW (in: hFindFile=0x169d9b8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.050] FindClose (in: hFindFile=0x169d9b8 | out: hFindFile=0x169d9b8) returned 1 [0063.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0063.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0063.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e7c0) returned 1 [0063.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG", nBufferLength=0x105, lpBuffer=0x138e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG", lpFilePart=0x0) returned 0x35 [0063.051] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\*", lpFindFileData=0x138e4e8 | out: lpFindFileData=0x138e4e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dab8 [0063.051] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4f87a40, ftCreationTime.dwHighDateTime=0x1d5ea66, ftLastAccessTime.dwLowDateTime=0x6290a900, ftLastAccessTime.dwHighDateTime=0x1d5e1dc, ftLastWriteTime.dwLowDateTime=0x6290a900, ftLastWriteTime.dwHighDateTime=0x1d5e1dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.051] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe300d5c0, ftCreationTime.dwHighDateTime=0x1d5eee2, ftLastAccessTime.dwLowDateTime=0x7483e550, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0x7483e550, ftLastWriteTime.dwHighDateTime=0x1d5f0dc, nFileSizeHigh=0x0, nFileSizeLow=0x1443d, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wDFs.avi", cAlternateFileName="")) returned 1 [0063.051] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa225910, ftCreationTime.dwHighDateTime=0x1d5ea62, ftLastAccessTime.dwLowDateTime=0x9fc1a030, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x9fc1a030, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x24f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7199yKnCUmoxD.mkv", cAlternateFileName="7199YK~1.MKV")) returned 1 [0063.051] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a70c30, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x926dfcb0, ftLastAccessTime.dwHighDateTime=0x1d5e6ad, ftLastWriteTime.dwLowDateTime=0x926dfcb0, ftLastWriteTime.dwHighDateTime=0x1d5e6ad, nFileSizeHigh=0x0, nFileSizeLow=0x30cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="D-nTnJ9ak4vtRGg.mp4", cAlternateFileName="D-NTNJ~1.MP4")) returned 1 [0063.051] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x999f2700, ftCreationTime.dwHighDateTime=0x1d5e182, ftLastAccessTime.dwLowDateTime=0x653c4860, ftLastAccessTime.dwHighDateTime=0x1d5eb9d, ftLastWriteTime.dwLowDateTime=0x653c4860, ftLastWriteTime.dwHighDateTime=0x1d5eb9d, nFileSizeHigh=0x0, nFileSizeLow=0x726a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISzk2iJ0yWhJ4w.swf", cAlternateFileName="ISZK2I~1.SWF")) returned 1 [0063.052] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b6e60, ftCreationTime.dwHighDateTime=0x1d5eace, ftLastAccessTime.dwLowDateTime=0x80620fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee8c, ftLastWriteTime.dwLowDateTime=0x80620fc0, ftLastWriteTime.dwHighDateTime=0x1d5ee8c, nFileSizeHigh=0x0, nFileSizeLow=0x9e49, dwReserved0=0x0, dwReserved1=0x0, cFileName="QFMsez47.mkv", cAlternateFileName="")) returned 1 [0063.052] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="U77k8xqMOibeFwZJOq", cAlternateFileName="U77K8X~1")) returned 1 [0063.052] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da64510, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0xd5361c0, ftLastAccessTime.dwHighDateTime=0x1d5f100, ftLastWriteTime.dwLowDateTime=0xd5361c0, ftLastWriteTime.dwHighDateTime=0x1d5f100, nFileSizeHigh=0x0, nFileSizeLow=0xe378, dwReserved0=0x0, dwReserved1=0x0, cFileName="vgS_5FELSSv3TXBfeX.mp4", cAlternateFileName="VGS_5F~1.MP4")) returned 1 [0063.052] FindNextFileW (in: hFindFile=0x169dab8, lpFindFileData=0x138e4f4 | out: lpFindFileData=0x138e4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da64510, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0xd5361c0, ftLastAccessTime.dwHighDateTime=0x1d5f100, ftLastWriteTime.dwLowDateTime=0xd5361c0, ftLastWriteTime.dwHighDateTime=0x1d5f100, nFileSizeHigh=0x0, nFileSizeLow=0xe378, dwReserved0=0x0, dwReserved1=0x0, cFileName="vgS_5FELSSv3TXBfeX.mp4", cAlternateFileName="VGS_5F~1.MP4")) returned 0 [0063.052] FindClose (in: hFindFile=0x169dab8 | out: hFindFile=0x169dab8) returned 1 [0063.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e77c) returned 1 [0063.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e788) returned 1 [0063.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", lpFilePart=0x0) returned 0x3f [0063.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\6wdfs.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.052] GetFileType (hFile=0x2e4) returned 0x1 [0063.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.053] GetFileType (hFile=0x2e4) returned 0x1 [0063.053] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x1443d [0063.053] ReadFile (in: hFile=0x2e4, lpBuffer=0x33d0fb4, nNumberOfBytesToRead=0x1443d, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33d0fb4*, lpNumberOfBytesRead=0x138e714*=0x1443d, lpOverlapped=0x0) returned 1 [0063.053] CloseHandle (hObject=0x2e4) returned 1 [0063.124] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", lpFilePart=0x0) returned 0x3f [0063.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0063.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\6wdfs.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.126] GetFileType (hFile=0x2e4) returned 0x1 [0063.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0063.126] GetFileType (hFile=0x2e4) returned 0x1 [0063.126] WriteFile (in: hFile=0x2e4, lpBuffer=0x345aa74*, nNumberOfBytesToWrite=0x14440, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x345aa74*, lpNumberOfBytesWritten=0x138e708*=0x14440, lpOverlapped=0x0) returned 1 [0063.128] CloseHandle (hObject=0x2e4) returned 1 [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi", lpFilePart=0x0) returned 0x3f [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi.a", lpFilePart=0x0) returned 0x41 [0063.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0063.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\6wdfs.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe300d5c0, ftCreationTime.dwHighDateTime=0x1d5eee2, ftLastAccessTime.dwLowDateTime=0x7483e550, ftLastAccessTime.dwHighDateTime=0x1d5f0dc, ftLastWriteTime.dwLowDateTime=0xd6937473, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x14440)) returned 1 [0063.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0063.131] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\6wdfs.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\6wDFs.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\6wdfs.avi.a")) returned 1 [0063.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", lpFilePart=0x0) returned 0x47 [0063.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.131] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\7199ykncumoxd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.131] GetFileType (hFile=0x2e4) returned 0x1 [0063.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.131] GetFileType (hFile=0x2e4) returned 0x1 [0063.131] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x24f3 [0063.131] ReadFile (in: hFile=0x2e4, lpBuffer=0x346f3ac, nNumberOfBytesToRead=0x24f3, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x346f3ac*, lpNumberOfBytesRead=0x138e714*=0x24f3, lpOverlapped=0x0) returned 1 [0063.132] CloseHandle (hObject=0x2e4) returned 1 [0063.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.223] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", lpFilePart=0x0) returned 0x47 [0063.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0063.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\7199ykncumoxd.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.224] GetFileType (hFile=0x2e4) returned 0x1 [0063.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0063.224] GetFileType (hFile=0x2e4) returned 0x1 [0063.224] WriteFile (in: hFile=0x2e4, lpBuffer=0x32cab98*, nNumberOfBytesToWrite=0x2500, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x32cab98*, lpNumberOfBytesWritten=0x138e708*=0x2500, lpOverlapped=0x0) returned 1 [0063.225] CloseHandle (hObject=0x2e4) returned 1 [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv", lpFilePart=0x0) returned 0x47 [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv.a", lpFilePart=0x0) returned 0x49 [0063.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0063.226] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\7199ykncumoxd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa225910, ftCreationTime.dwHighDateTime=0x1d5ea62, ftLastAccessTime.dwLowDateTime=0x9fc1a030, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xd6a1c3d6, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x2500)) returned 1 [0063.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0063.226] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\7199ykncumoxd.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\7199yKnCUmoxD.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\7199ykncumoxd.mkv.a")) returned 1 [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", lpFilePart=0x0) returned 0x49 [0063.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\d-ntnj9ak4vtrgg.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.227] GetFileType (hFile=0x2e4) returned 0x1 [0063.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.227] GetFileType (hFile=0x2e4) returned 0x1 [0063.227] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x30cc [0063.227] ReadFile (in: hFile=0x2e4, lpBuffer=0x32cd5e8, nNumberOfBytesToRead=0x30cc, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x32cd5e8*, lpNumberOfBytesRead=0x138e714*=0x30cc, lpOverlapped=0x0) returned 1 [0063.227] CloseHandle (hObject=0x2e4) returned 1 [0063.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", lpFilePart=0x0) returned 0x49 [0063.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0063.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\d-ntnj9ak4vtrgg.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.243] GetFileType (hFile=0x2e4) returned 0x1 [0063.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0063.243] GetFileType (hFile=0x2e4) returned 0x1 [0063.243] WriteFile (in: hFile=0x2e4, lpBuffer=0x332993c*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x332993c*, lpNumberOfBytesWritten=0x138e708*=0x30d0, lpOverlapped=0x0) returned 1 [0063.244] CloseHandle (hObject=0x2e4) returned 1 [0063.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4", lpFilePart=0x0) returned 0x49 [0063.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4.a", lpFilePart=0x0) returned 0x4b [0063.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0063.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\d-ntnj9ak4vtrgg.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0a70c30, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0x926dfcb0, ftLastAccessTime.dwHighDateTime=0x1d5e6ad, ftLastWriteTime.dwLowDateTime=0xd6a4280e, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x30d0)) returned 1 [0063.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0063.245] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\d-ntnj9ak4vtrgg.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\D-nTnJ9ak4vtRGg.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\d-ntnj9ak4vtrgg.mp4.a")) returned 1 [0063.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", lpFilePart=0x0) returned 0x42 [0063.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\qfmsez47.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.246] GetFileType (hFile=0x2e4) returned 0x1 [0063.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.246] GetFileType (hFile=0x2e4) returned 0x1 [0063.246] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0x9e49 [0063.246] ReadFile (in: hFile=0x2e4, lpBuffer=0x332cf70, nNumberOfBytesToRead=0x9e49, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x332cf70*, lpNumberOfBytesRead=0x138e714*=0x9e49, lpOverlapped=0x0) returned 1 [0063.246] CloseHandle (hObject=0x2e4) returned 1 [0063.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.309] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", lpFilePart=0x0) returned 0x42 [0063.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0063.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\qfmsez47.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.310] GetFileType (hFile=0x2e4) returned 0x1 [0063.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0063.310] GetFileType (hFile=0x2e4) returned 0x1 [0063.310] WriteFile (in: hFile=0x2e4, lpBuffer=0x33ab4ec*, nNumberOfBytesToWrite=0x9e50, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x33ab4ec*, lpNumberOfBytesWritten=0x138e708*=0x9e50, lpOverlapped=0x0) returned 1 [0063.311] CloseHandle (hObject=0x2e4) returned 1 [0063.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv", lpFilePart=0x0) returned 0x42 [0063.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv.a", lpFilePart=0x0) returned 0x44 [0063.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0063.313] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\qfmsez47.mkv"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf6b6e60, ftCreationTime.dwHighDateTime=0x1d5eace, ftLastAccessTime.dwLowDateTime=0x80620fc0, ftLastAccessTime.dwHighDateTime=0x1d5ee8c, ftLastWriteTime.dwLowDateTime=0xd6b010bd, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x9e50)) returned 1 [0063.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0063.313] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\qfmsez47.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\QFMsez47.mkv.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\qfmsez47.mkv.a")) returned 1 [0063.314] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", nBufferLength=0x105, lpBuffer=0x138e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", lpFilePart=0x0) returned 0x4c [0063.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e66c) returned 1 [0063.314] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\vgs_5felssv3txbfex.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.314] GetFileType (hFile=0x2e4) returned 0x1 [0063.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e668) returned 1 [0063.314] GetFileType (hFile=0x2e4) returned 0x1 [0063.314] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e768 | out: lpFileSizeHigh=0x138e768*=0x0) returned 0xe378 [0063.314] ReadFile (in: hFile=0x2e4, lpBuffer=0x33b5874, nNumberOfBytesToRead=0xe378, lpNumberOfBytesRead=0x138e714, lpOverlapped=0x0 | out: lpBuffer=0x33b5874*, lpNumberOfBytesRead=0x138e714*=0xe378, lpOverlapped=0x0) returned 1 [0063.314] CloseHandle (hObject=0x2e4) returned 1 [0063.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e22c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.330] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e75c | out: lpFileInformation=0x138e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", nBufferLength=0x105, lpBuffer=0x138e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", lpFilePart=0x0) returned 0x4c [0063.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e658) returned 1 [0063.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\vgs_5felssv3txbfex.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.332] GetFileType (hFile=0x2e4) returned 0x1 [0063.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e654) returned 1 [0063.332] GetFileType (hFile=0x2e4) returned 0x1 [0063.332] WriteFile (in: hFile=0x2e4, lpBuffer=0x342d0f0*, nNumberOfBytesToWrite=0xe380, lpNumberOfBytesWritten=0x138e708, lpOverlapped=0x0 | out: lpBuffer=0x342d0f0*, lpNumberOfBytesWritten=0x138e708*=0xe380, lpOverlapped=0x0) returned 1 [0063.334] CloseHandle (hObject=0x2e4) returned 1 [0063.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4", lpFilePart=0x0) returned 0x4c [0063.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4.a", nBufferLength=0x105, lpBuffer=0x138e238, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4.a", lpFilePart=0x0) returned 0x4e [0063.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6ec) returned 1 [0063.335] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\vgs_5felssv3txbfex.mp4"), fInfoLevelId=0x0, lpFileInformation=0x138e768 | out: lpFileInformation=0x138e768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6da64510, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0xd5361c0, ftLastAccessTime.dwHighDateTime=0x1d5f100, ftLastWriteTime.dwLowDateTime=0xd6b27438, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0xe380)) returned 1 [0063.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6e8) returned 1 [0063.336] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\vgs_5felssv3txbfex.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\vgS_5FELSSv3TXBfeX.mp4.a" (normalized: "c:\\users\\fd1hvy\\videos\\lf4srlkhb9\\k4ywox0eawxmx__rnrg\\vgs_5felssv3txbfex.mp4.a")) returned 1 [0063.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0063.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq", lpFilePart=0x0) returned 0x48 [0063.336] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0063.336] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e4d220, ftCreationTime.dwHighDateTime=0x1d5ea99, ftLastAccessTime.dwLowDateTime=0x9380f10, ftLastAccessTime.dwHighDateTime=0x1d5ef3d, ftLastWriteTime.dwLowDateTime=0x9380f10, ftLastWriteTime.dwHighDateTime=0x1d5ef3d, nFileSizeHigh=0x0, nFileSizeLow=0x5bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0gX4Kob.flv", cAlternateFileName="")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212908d0, ftCreationTime.dwHighDateTime=0x1d5e458, ftLastAccessTime.dwLowDateTime=0xbfbf67e0, ftLastAccessTime.dwHighDateTime=0x1d5eada, ftLastWriteTime.dwLowDateTime=0xbfbf67e0, ftLastWriteTime.dwHighDateTime=0x1d5eada, nFileSizeHigh=0x0, nFileSizeLow=0xb1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pGmRixzQw.flv", cAlternateFileName="PGMRIX~1.FLV")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1758b3f0, ftCreationTime.dwHighDateTime=0x1d5edf4, ftLastAccessTime.dwLowDateTime=0xaa826180, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xaa826180, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0x11c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="zsy9NUvgaUuOMpXP3_4b.swf", cAlternateFileName="ZSY9NU~1.SWF")) returned 1 [0063.337] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.337] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0063.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0063.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0063.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e74c) returned 1 [0063.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq", nBufferLength=0x105, lpBuffer=0x138e200, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq", lpFilePart=0x0) returned 0x48 [0063.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lf4sRlkHb9\\k4YWOx0eAwxMX__rnRG\\U77k8xqMOibeFwZJOq\\*", lpFindFileData=0x138e474 | out: lpFindFileData=0x138e474*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0063.337] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x199c89a0, ftCreationTime.dwHighDateTime=0x1d5e1e4, ftLastAccessTime.dwLowDateTime=0xa40771c0, ftLastAccessTime.dwHighDateTime=0x1d5f032, ftLastWriteTime.dwLowDateTime=0xa40771c0, ftLastWriteTime.dwHighDateTime=0x1d5f032, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68e4d220, ftCreationTime.dwHighDateTime=0x1d5ea99, ftLastAccessTime.dwLowDateTime=0x9380f10, ftLastAccessTime.dwHighDateTime=0x1d5ef3d, ftLastWriteTime.dwLowDateTime=0x9380f10, ftLastWriteTime.dwHighDateTime=0x1d5ef3d, nFileSizeHigh=0x0, nFileSizeLow=0x5bbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0gX4Kob.flv", cAlternateFileName="")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212908d0, ftCreationTime.dwHighDateTime=0x1d5e458, ftLastAccessTime.dwLowDateTime=0xbfbf67e0, ftLastAccessTime.dwHighDateTime=0x1d5eada, ftLastWriteTime.dwLowDateTime=0xbfbf67e0, ftLastWriteTime.dwHighDateTime=0x1d5eada, nFileSizeHigh=0x0, nFileSizeLow=0xb1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="pGmRixzQw.flv", cAlternateFileName="PGMRIX~1.FLV")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1758b3f0, ftCreationTime.dwHighDateTime=0x1d5edf4, ftLastAccessTime.dwLowDateTime=0xaa826180, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xaa826180, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0x11c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="zsy9NUvgaUuOMpXP3_4b.swf", cAlternateFileName="ZSY9NU~1.SWF")) returned 1 [0063.338] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e480 | out: lpFindFileData=0x138e480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1758b3f0, ftCreationTime.dwHighDateTime=0x1d5edf4, ftLastAccessTime.dwLowDateTime=0xaa826180, ftLastAccessTime.dwHighDateTime=0x1d5e35e, ftLastWriteTime.dwLowDateTime=0xaa826180, ftLastWriteTime.dwHighDateTime=0x1d5e35e, nFileSizeHigh=0x0, nFileSizeLow=0x11c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="zsy9NUvgaUuOMpXP3_4b.swf", cAlternateFileName="ZSY9NU~1.SWF")) returned 0 [0063.338] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0063.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e708) returned 1 [0063.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e714) returned 1 [0063.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0063.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv", lpFilePart=0x0) returned 0x26 [0063.338] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84dcf890, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xad944370, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0xad944370, ftLastWriteTime.dwHighDateTime=0x1d5ebc4, nFileSizeHigh=0x0, nFileSizeLow=0x12491, dwReserved0=0x0, dwReserved1=0x0, cFileName="30Pz2rALSR7mz.avi", cAlternateFileName="30PZ2R~1.AVI")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fce9110, ftCreationTime.dwHighDateTime=0x1d5e6e5, ftLastAccessTime.dwLowDateTime=0x8a6e2ec0, ftLastAccessTime.dwHighDateTime=0x1d5e759, ftLastWriteTime.dwLowDateTime=0x8a6e2ec0, ftLastWriteTime.dwHighDateTime=0x1d5e759, nFileSizeHigh=0x0, nFileSizeLow=0x1307a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cMiCzgrCWF2OpZNnhb.swf", cAlternateFileName="CMICZG~1.SWF")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d7c00, ftCreationTime.dwHighDateTime=0x1d5eedd, ftLastAccessTime.dwLowDateTime=0x61bd5110, ftLastAccessTime.dwHighDateTime=0x1d5e8fb, ftLastWriteTime.dwLowDateTime=0x61bd5110, ftLastWriteTime.dwHighDateTime=0x1d5e8fb, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="glGLT4xadCGq.flv", cAlternateFileName="GLGLT4~1.FLV")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62074dd0, ftCreationTime.dwHighDateTime=0x1d5f00b, ftLastAccessTime.dwLowDateTime=0x2f7ea360, ftLastAccessTime.dwHighDateTime=0x1d5ea41, ftLastWriteTime.dwLowDateTime=0x2f7ea360, ftLastWriteTime.dwHighDateTime=0x1d5ea41, nFileSizeHigh=0x0, nFileSizeLow=0x40a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ycqmz Kkbn2GcpeLgjja.swf", cAlternateFileName="YCQMZK~1.SWF")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5015a0, ftCreationTime.dwHighDateTime=0x1d5e3ae, ftLastAccessTime.dwLowDateTime=0x9b39c680, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0x9b39c680, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x87ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="z BrZiGw.flv", cAlternateFileName="ZBRZIG~1.FLV")) returned 1 [0063.339] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.339] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0063.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0063.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0063.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e834) returned 1 [0063.340] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv", nBufferLength=0x105, lpBuffer=0x138e2e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv", lpFilePart=0x0) returned 0x26 [0063.340] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\*", lpFindFileData=0x138e55c | out: lpFindFileData=0x138e55c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x169dd38 [0063.340] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cd34690, ftCreationTime.dwHighDateTime=0x1d5e8c7, ftLastAccessTime.dwLowDateTime=0x66cfb180, ftLastAccessTime.dwHighDateTime=0x1d5e62a, ftLastWriteTime.dwLowDateTime=0x66cfb180, ftLastWriteTime.dwHighDateTime=0x1d5e62a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84dcf890, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xad944370, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0xad944370, ftLastWriteTime.dwHighDateTime=0x1d5ebc4, nFileSizeHigh=0x0, nFileSizeLow=0x12491, dwReserved0=0x0, dwReserved1=0x0, cFileName="30Pz2rALSR7mz.avi", cAlternateFileName="30PZ2R~1.AVI")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fce9110, ftCreationTime.dwHighDateTime=0x1d5e6e5, ftLastAccessTime.dwLowDateTime=0x8a6e2ec0, ftLastAccessTime.dwHighDateTime=0x1d5e759, ftLastWriteTime.dwLowDateTime=0x8a6e2ec0, ftLastWriteTime.dwHighDateTime=0x1d5e759, nFileSizeHigh=0x0, nFileSizeLow=0x1307a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cMiCzgrCWF2OpZNnhb.swf", cAlternateFileName="CMICZG~1.SWF")) returned 1 [0063.340] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d7c00, ftCreationTime.dwHighDateTime=0x1d5eedd, ftLastAccessTime.dwLowDateTime=0x61bd5110, ftLastAccessTime.dwHighDateTime=0x1d5e8fb, ftLastWriteTime.dwLowDateTime=0x61bd5110, ftLastWriteTime.dwHighDateTime=0x1d5e8fb, nFileSizeHigh=0x0, nFileSizeLow=0x1f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="glGLT4xadCGq.flv", cAlternateFileName="GLGLT4~1.FLV")) returned 1 [0063.388] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62074dd0, ftCreationTime.dwHighDateTime=0x1d5f00b, ftLastAccessTime.dwLowDateTime=0x2f7ea360, ftLastAccessTime.dwHighDateTime=0x1d5ea41, ftLastWriteTime.dwLowDateTime=0x2f7ea360, ftLastWriteTime.dwHighDateTime=0x1d5ea41, nFileSizeHigh=0x0, nFileSizeLow=0x40a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ycqmz Kkbn2GcpeLgjja.swf", cAlternateFileName="YCQMZK~1.SWF")) returned 1 [0063.388] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5015a0, ftCreationTime.dwHighDateTime=0x1d5e3ae, ftLastAccessTime.dwLowDateTime=0x9b39c680, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0x9b39c680, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x87ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="z BrZiGw.flv", cAlternateFileName="ZBRZIG~1.FLV")) returned 1 [0063.388] FindNextFileW (in: hFindFile=0x169dd38, lpFindFileData=0x138e568 | out: lpFindFileData=0x138e568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d5015a0, ftCreationTime.dwHighDateTime=0x1d5e3ae, ftLastAccessTime.dwLowDateTime=0x9b39c680, ftLastAccessTime.dwHighDateTime=0x1d5e27a, ftLastWriteTime.dwLowDateTime=0x9b39c680, ftLastWriteTime.dwHighDateTime=0x1d5e27a, nFileSizeHigh=0x0, nFileSizeLow=0x87ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="z BrZiGw.flv", cAlternateFileName="ZBRZIG~1.FLV")) returned 0 [0063.388] FindClose (in: hFindFile=0x169dd38 | out: hFindFile=0x169dd38) returned 1 [0063.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7f0) returned 1 [0063.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e7fc) returned 1 [0063.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", nBufferLength=0x105, lpBuffer=0x138e19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", lpFilePart=0x0) returned 0x38 [0063.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6e0) returned 1 [0063.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sj-bgujrbcwzvzv\\30pz2ralsr7mz.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.389] GetFileType (hFile=0x2e4) returned 0x1 [0063.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6dc) returned 1 [0063.389] GetFileType (hFile=0x2e4) returned 0x1 [0063.389] GetFileSize (in: hFile=0x2e4, lpFileSizeHigh=0x138e7dc | out: lpFileSizeHigh=0x138e7dc*=0x0) returned 0x12491 [0063.389] ReadFile (in: hFile=0x2e4, lpBuffer=0x343f614, nNumberOfBytesToRead=0x12491, lpNumberOfBytesRead=0x138e788, lpOverlapped=0x0 | out: lpBuffer=0x343f614*, lpNumberOfBytesRead=0x138e788*=0x12491, lpOverlapped=0x0) returned 1 [0063.389] CloseHandle (hObject=0x2e4) returned 1 [0063.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e2a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e754) returned 1 [0063.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), fInfoLevelId=0x0, lpFileInformation=0x138e7d0 | out: lpFileInformation=0x138e7d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e750) returned 1 [0063.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", nBufferLength=0x105, lpBuffer=0x138e188, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", lpFilePart=0x0) returned 0x38 [0063.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e6cc) returned 1 [0063.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sj-bgujrbcwzvzv\\30pz2ralsr7mz.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e4 [0063.482] GetFileType (hFile=0x2e4) returned 0x1 [0063.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e6c8) returned 1 [0063.482] GetFileType (hFile=0x2e4) returned 0x1 [0063.482] WriteFile (in: hFile=0x2e4, lpBuffer=0x32dab18*, nNumberOfBytesToWrite=0x124a0, lpNumberOfBytesWritten=0x138e77c, lpOverlapped=0x0 | out: lpBuffer=0x32dab18*, lpNumberOfBytesWritten=0x138e77c*=0x124a0, lpOverlapped=0x0) returned 1 [0063.484] CloseHandle (hObject=0x2e4) returned 1 [0063.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi", lpFilePart=0x0) returned 0x38 [0063.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi.a", nBufferLength=0x105, lpBuffer=0x138e2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi.a", lpFilePart=0x0) returned 0x3a [0063.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e760) returned 1 [0063.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sj-bgujrbcwzvzv\\30pz2ralsr7mz.avi"), fInfoLevelId=0x0, lpFileInformation=0x138e7dc | out: lpFileInformation=0x138e7dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84dcf890, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xad944370, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0xd6ca4985, ftLastWriteTime.dwHighDateTime=0x1d6eb12, nFileSizeHigh=0x0, nFileSizeLow=0x124a0)) returned 1 [0063.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e75c) returned 1 [0063.487] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi" (normalized: "c:\\users\\fd1hvy\\videos\\sj-bgujrbcwzvzv\\30pz2ralsr7mz.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\sJ-bgujrBCwZVZv\\30Pz2rALSR7mz.avi.a" (normalized: "c:\\users\\fd1hvy\\videos\\sj-bgujrbcwzvzv\\30pz2ralsr7mz.avi.a")) returned 1 [0063.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", nBufferLength=0x105, lpBuffer=0x138e340, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt", lpFilePart=0x0) returned 0x23 [0063.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e884) returned 1 [0063.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2e4 [0063.622] GetFileType (hFile=0x2e4) returned 0x1 [0063.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e880) returned 1 [0063.622] GetFileType (hFile=0x2e4) returned 0x1 [0063.625] WriteFile (in: hFile=0x2e4, lpBuffer=0x32efa6c*, nNumberOfBytesToWrite=0x2ff, lpNumberOfBytesWritten=0x138e8e4, lpOverlapped=0x0 | out: lpBuffer=0x32efa6c*, lpNumberOfBytesWritten=0x138e8e4*=0x2ff, lpOverlapped=0x0) returned 1 [0063.626] CloseHandle (hObject=0x2e4) returned 1 [0063.705] GetCurrentProcess () returned 0xffffffff [0063.705] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e59c | out: TokenHandle=0x138e59c*=0x2d0) returned 1 [0063.716] GetCurrentProcess () returned 0xffffffff [0063.716] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e5ac | out: TokenHandle=0x138e5ac*=0x2d4) returned 1 [0063.764] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2e8 [0063.765] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2d8 [0063.768] GetCurrentProcess () returned 0xffffffff [0063.768] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e5bc | out: TokenHandle=0x138e5bc*=0x2dc) returned 1 [0063.770] GetCurrentProcess () returned 0xffffffff [0063.770] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e5cc | out: TokenHandle=0x138e5cc*=0x2cc) returned 1 [0063.774] QueryPerformanceFrequency (in: lpFrequency=0x1465a98 | out: lpFrequency=0x1465a98*=100000000) returned 1 [0063.774] QueryPerformanceCounter (in: lpPerformanceCount=0x138e940 | out: lpPerformanceCount=0x138e940*=15955424614) returned 1 [0063.777] GetCurrentProcess () returned 0xffffffff [0063.777] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e588 | out: TokenHandle=0x138e588*=0x2e0) returned 1 [0063.780] GetCurrentProcess () returned 0xffffffff [0063.780] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e598 | out: TokenHandle=0x138e598*=0x3fc) returned 1 [0063.792] GetCurrentProcess () returned 0xffffffff [0063.792] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e59c | out: TokenHandle=0x138e59c*=0x410) returned 1 [0063.794] GetCurrentProcess () returned 0xffffffff [0063.794] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e5ac | out: TokenHandle=0x138e5ac*=0x414) returned 1 [0063.797] GetCurrentProcess () returned 0xffffffff [0063.797] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e824 | out: TokenHandle=0x138e824*=0x418) returned 1 [0063.802] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x138d95c | out: phkResult=0x138d95c*=0x41c) returned 0x0 [0063.803] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x138d97c, lpData=0x0, lpcbData=0x138d978*=0x0 | out: lpType=0x138d97c*=0x1, lpData=0x0, lpcbData=0x138d978*=0xe) returned 0x0 [0063.803] RegQueryValueExW (in: hKey=0x41c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x138d97c, lpData=0x32fabac, lpcbData=0x138d978*=0xe | out: lpType=0x138d97c*=0x1, lpData="Client", lpcbData=0x138d978*=0xe) returned 0x0 [0063.803] RegCloseKey (hKey=0x41c) returned 0x0 [0064.490] CoTaskMemAlloc (cb=0xcc0) returned 0x83ea7f8 [0064.493] RasEnumConnectionsW (in: param_1=0x83ea7f8, param_2=0x138e834, param_3=0x138e838 | out: param_1=0x83ea7f8, param_2=0x138e834, param_3=0x138e838) returned 0x0 [0064.824] CoTaskMemFree (pv=0x83ea7f8) [0065.242] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x138e620 | out: lpWSAData=0x138e620) returned 0 [0065.248] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x480 [0065.782] setsockopt (s=0x480, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0065.782] closesocket (s=0x480) returned 0 [0065.782] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x480 [0065.787] setsockopt (s=0x480, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0065.787] closesocket (s=0x480) returned 0 [0065.787] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x480 [0065.788] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x484 [0065.788] ioctlsocket (in: s=0x480, cmd=-2147195266, argp=0x138e83c | out: argp=0x138e83c) returned 0 [0065.788] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x488 [0065.788] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x48c [0065.788] ioctlsocket (in: s=0x488, cmd=-2147195266, argp=0x138e83c | out: argp=0x138e83c) returned 0 [0065.789] WSAIoctl (in: s=0x480, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x138e824, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x138e824, lpOverlapped=0x0) returned -1 [0065.791] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x138e554, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.802] WSAEventSelect (s=0x480, hEventObject=0x484, lNetworkEvents=512) returned 0 [0065.803] WSAIoctl (in: s=0x488, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x138e824, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x138e824, lpOverlapped=0x0) returned -1 [0065.803] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x138e554, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.804] WSAEventSelect (s=0x488, hEventObject=0x48c, lNetworkEvents=512) returned 0 [0065.804] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x494 [0065.804] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x494, param_3=0x3) returned 0x0 [0065.820] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x138e850 | out: phkResult=0x138e850*=0x4ac) returned 0x0 [0065.821] RegOpenKeyExW (in: hKey=0x4ac, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e804 | out: phkResult=0x138e804*=0x4b0) returned 0x0 [0065.821] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4b4 [0065.821] RegNotifyChangeKeyValue (hKey=0x4b0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4b4, fAsynchronous=1) returned 0x0 [0065.822] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e808 | out: phkResult=0x138e808*=0x4b8) returned 0x0 [0065.823] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4bc [0065.823] RegNotifyChangeKeyValue (hKey=0x4b8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4bc, fAsynchronous=1) returned 0x0 [0065.823] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e808 | out: phkResult=0x138e808*=0x4c0) returned 0x0 [0065.824] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0065.824] RegNotifyChangeKeyValue (hKey=0x4c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c4, fAsynchronous=1) returned 0x0 [0065.824] GetCurrentProcess () returned 0xffffffff [0065.824] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e7f4 | out: TokenHandle=0x138e7f4*=0x4c8) returned 1 [0065.828] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e100 | out: phkResult=0x138e100*=0x4cc) returned 0x0 [0065.828] RegQueryValueExW (in: hKey=0x4cc, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x138e11c, lpData=0x0, lpcbData=0x138e118*=0x0 | out: lpType=0x138e11c*=0x0, lpData=0x0, lpcbData=0x138e118*=0x0) returned 0x2 [0065.828] RegCloseKey (hKey=0x4cc) returned 0x0 [0066.372] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x83f21c8 [0066.769] WinHttpSetTimeouts (hInternet=0x83f21c8, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0066.770] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x138e804 | out: pProxyConfig=0x138e804) returned 1 [0067.131] CoTaskMemAlloc (cb=0x20e) returned 0x84047a8 [0067.131] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x84047a8, nSize=0x105 | out: lpBuffer="槨ࡀ偈Ŭណ潊᝾潊\x03") returned 0x0 [0067.131] CoTaskMemFree (pv=0x84047a8) [0067.131] CoTaskMemAlloc (cb=0x20e) returned 0x84047a8 [0067.131] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x84047a8, nSize=0x105 | out: lpBuffer="槨ࡀ偈Ŭណ潊᝾潊\x03") returned 0x0 [0067.131] CoTaskMemFree (pv=0x84047a8) [0067.136] EtwEventRegister (in: ProviderId=0x32fd944, EnableCallback=0x3220636, CallbackContext=0x0, RegHandle=0x32fd920 | out: RegHandle=0x32fd920) returned 0x0 [0067.136] EtwEventSetInformation (RegHandle=0x16c30a8, InformationClass=0x65, EventInformation=0x2, InformationLength=0x32fd8e0) returned 0x0 [0067.138] GetCurrentProcess () returned 0xffffffff [0067.138] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e564 | out: TokenHandle=0x138e564*=0x510) returned 1 [0067.140] GetCurrentProcess () returned 0xffffffff [0067.140] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e574 | out: TokenHandle=0x138e574*=0x514) returned 1 [0067.143] SetEvent (hEvent=0x2e8) returned 1 [0067.162] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e76c*=0x494, lpdwindex=0x138e58c | out: lpdwindex=0x138e58c) returned 0x80010115 [0072.593] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e74c*=0x484, lpdwindex=0x138e56c | out: lpdwindex=0x138e56c) returned 0x80010115 [0072.594] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e74c*=0x48c, lpdwindex=0x138e56c | out: lpdwindex=0x138e56c) returned 0x80010115 [0072.594] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e7a0*=0x4b4, lpdwindex=0x138e5bc | out: lpdwindex=0x138e5bc) returned 0x80010115 [0072.594] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e7a0*=0x4bc, lpdwindex=0x138e5bc | out: lpdwindex=0x138e5bc) returned 0x80010115 [0072.595] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e7a0*=0x4c4, lpdwindex=0x138e5bc | out: lpdwindex=0x138e5bc) returned 0x80010115 [0072.600] GetCurrentProcess () returned 0xffffffff [0072.600] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e4dc | out: TokenHandle=0x138e4dc*=0x558) returned 1 [0072.600] GetCurrentProcess () returned 0xffffffff [0072.601] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e4ec | out: TokenHandle=0x138e4ec*=0x55c) returned 1 [0072.602] GetTimeZoneInformation (in: lpTimeZoneInformation=0x138e65c | out: lpTimeZoneInformation=0x138e65c) returned 0x1 [0072.604] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x138e4b8 | out: pTimeZoneInformation=0x138e4b8) returned 0x1 [0072.605] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e59c | out: phkResult=0x138e59c*=0x560) returned 0x0 [0072.606] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0x138e5b8, lpData=0x0, lpcbData=0x138e5b4*=0x0 | out: lpType=0x138e5b8*=0x3, lpData=0x0, lpcbData=0x138e5b4*=0x2c) returned 0x0 [0072.606] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0x138e5b8, lpData=0x330095c, lpcbData=0x138e5b4*=0x2c | out: lpType=0x138e5b8*=0x3, lpData=0x330095c*, lpcbData=0x138e5b4*=0x2c) returned 0x0 [0072.606] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e3f0 | out: phkResult=0x138e3f0*=0x0) returned 0x2 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x138e590, lpData=0x0, lpcbData=0x138e58c*=0x0 | out: lpType=0x138e590*=0x1, lpData=0x0, lpcbData=0x138e58c*=0x20) returned 0x0 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x138e590, lpData=0x3300d80, lpcbData=0x138e58c*=0x20 | out: lpType=0x138e590*=0x1, lpData="@tzres.dll,-320", lpcbData=0x138e58c*=0x20) returned 0x0 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x138e590, lpData=0x0, lpcbData=0x138e58c*=0x0 | out: lpType=0x138e590*=0x1, lpData=0x0, lpcbData=0x138e58c*=0x20) returned 0x0 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x138e590, lpData=0x3300dd8, lpcbData=0x138e58c*=0x20 | out: lpType=0x138e590*=0x1, lpData="@tzres.dll,-322", lpcbData=0x138e58c*=0x20) returned 0x0 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x138e590, lpData=0x0, lpcbData=0x138e58c*=0x0 | out: lpType=0x138e590*=0x1, lpData=0x0, lpcbData=0x138e58c*=0x20) returned 0x0 [0072.607] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x138e590, lpData=0x3300e30, lpcbData=0x138e58c*=0x20 | out: lpType=0x138e590*=0x1, lpData="@tzres.dll,-321", lpcbData=0x138e58c*=0x20) returned 0x0 [0072.613] CoTaskMemAlloc (cb=0x20c) returned 0x8411db8 [0072.613] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8411db8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0072.615] CoTaskMemFree (pv=0x8411db8) [0072.615] CoTaskMemAlloc (cb=0x20e) returned 0x8411db8 [0072.615] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath=0x8411db8, pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4 | out: pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4) returned 1 [0072.699] CoTaskMemFree (pv=0x0) [0072.699] CoTaskMemFree (pv=0x8411db8) [0072.700] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8cb0001 [0072.711] CoTaskMemAlloc (cb=0x3ec) returned 0x83f8188 [0072.711] LoadStringW (in: hInstance=0x8cb0001, uID=0x140, lpBuffer=0x83f8188, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0072.711] CoTaskMemFree (pv=0x83f8188) [0072.711] FreeLibrary (hLibModule=0x8cb0001) returned 1 [0072.712] CoTaskMemAlloc (cb=0x20c) returned 0x8411db8 [0072.712] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8411db8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0072.712] CoTaskMemFree (pv=0x8411db8) [0072.712] CoTaskMemAlloc (cb=0x20e) returned 0x8411db8 [0072.712] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath=0x8411db8, pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4 | out: pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4) returned 1 [0072.712] CoTaskMemFree (pv=0x0) [0072.713] CoTaskMemFree (pv=0x8411db8) [0072.713] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8cb0001 [0072.713] CoTaskMemAlloc (cb=0x3ec) returned 0x83f8188 [0072.713] LoadStringW (in: hInstance=0x8cb0001, uID=0x142, lpBuffer=0x83f8188, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0072.713] CoTaskMemFree (pv=0x83f8188) [0072.713] FreeLibrary (hLibModule=0x8cb0001) returned 1 [0072.714] CoTaskMemAlloc (cb=0x20c) returned 0x8411db8 [0072.714] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x8411db8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0072.714] CoTaskMemFree (pv=0x8411db8) [0072.714] CoTaskMemAlloc (cb=0x20e) returned 0x8411db8 [0072.714] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath=0x8411db8, pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4 | out: pwszLanguage=0x0, pcchLanguage=0x138e5ac, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x138e5b0, pululEnumerator=0x138e5a4) returned 1 [0072.714] CoTaskMemFree (pv=0x0) [0072.714] CoTaskMemFree (pv=0x8411db8) [0072.714] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8cb0001 [0072.715] CoTaskMemAlloc (cb=0x3ec) returned 0x83f8188 [0072.715] LoadStringW (in: hInstance=0x8cb0001, uID=0x141, lpBuffer=0x83f8188, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0072.715] CoTaskMemFree (pv=0x83f8188) [0072.715] FreeLibrary (hLibModule=0x8cb0001) returned 1 [0072.716] RegCloseKey (hKey=0x560) returned 0x0 [0072.716] SetEvent (hEvent=0x2e8) returned 1 [0072.726] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x138e7b8 | out: pFixedInfo=0x0, pOutBufLen=0x138e7b8) returned 0x6f [0074.155] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x840f2e8 [0074.155] GetNetworkParams (in: pFixedInfo=0x840f2e8, pOutBufLen=0x138e7b8 | out: pFixedInfo=0x840f2e8, pOutBufLen=0x138e7b8) returned 0x0 [0074.281] LocalFree (hMem=0x840f2e8) returned 0x0 [0074.282] CoTaskMemAlloc (cb=0x20e) returned 0x8411db8 [0074.282] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x8411db8, nSize=0x105 | out: lpBuffer="ࡀ륀࠿") returned 0x0 [0074.282] CoTaskMemFree (pv=0x8411db8) [0074.282] CoTaskMemAlloc (cb=0x20e) returned 0x8411db8 [0074.282] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x8411db8, nSize=0x105 | out: lpBuffer="ࡀ륀࠿") returned 0x0 [0074.282] CoTaskMemFree (pv=0x8411db8) [0074.284] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5a4 [0074.286] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x57c [0074.287] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x138e6a0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x138e648 | out: ppResult=0x138e648*=0x16ca188*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x8406598*(sa_family=2, sin_port=0x0, sin_addr="172.217.16.132"), ai_next=0x0)) returned 0 [0074.746] FreeAddrInfoW (pAddrInfo=0x16ca188*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0x8406598*(sa_family=2, sin_port=0x0, sin_addr="172.217.16.132"), ai_next=0x0)) [0074.749] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5ac [0074.749] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5b4 [0074.749] ioctlsocket (in: s=0x5ac, cmd=-2147195266, argp=0x138e674 | out: argp=0x138e674) returned 0 [0074.749] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5b8 [0074.749] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5bc [0074.749] ioctlsocket (in: s=0x5b8, cmd=-2147195266, argp=0x138e674 | out: argp=0x138e674) returned 0 [0074.749] WSAIoctl (in: s=0x5ac, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x138e65c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x138e65c, lpOverlapped=0x0) returned -1 [0074.750] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x138e38c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0074.750] WSAEventSelect (s=0x5ac, hEventObject=0x5b4, lNetworkEvents=512) returned 0 [0074.750] WSAIoctl (in: s=0x5b8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x138e65c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x138e65c, lpOverlapped=0x0) returned -1 [0074.750] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x138e38c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0074.750] WSAEventSelect (s=0x5b8, hEventObject=0x5bc, lNetworkEvents=512) returned 0 [0074.750] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x138e658*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x138e658*=0x818) returned 0x6f [0074.756] LocalAlloc (uFlags=0x0, uBytes=0x818) returned 0x16dc7e0 [0074.756] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x16dc7e0, SizePointer=0x138e658*=0x818 | out: AdapterAddresses=0x16dc7e0*(Alignment=0x300000178, Length=0x178, IfIndex=0x3, Next=0x16dca90, AdapterName="{9E48833B-70C6-43EE-85DC-893C1782D802}", FirstUnicastAddress=0x16dca04, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0xc0, [2]=0xb0, [3]=0xf4, [4]=0x2f, [5]=0xf2, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x3, ZoneIndices=([0]=0x3, [1]=0x3, [2]=0x3, [3]=0x3, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x16dc958*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0x138e658*=0x818) returned 0x0 [0074.805] LocalFree (hMem=0x16dc7e0) returned 0x0 [0074.809] WSAConnect (in: s=0x5a4, name=0x330c7f8*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.16.132"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0074.828] closesocket (s=0x57c) returned 0 [0074.838] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5a8 | out: phkResult=0x138e5a8*=0x57c) returned 0x0 [0074.839] RegQueryValueExW (in: hKey=0x57c, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x138e5c4, lpData=0x0, lpcbData=0x138e5c0*=0x0 | out: lpType=0x138e5c4*=0x0, lpData=0x0, lpcbData=0x138e5c0*=0x0) returned 0x2 [0074.839] RegCloseKey (hKey=0x57c) returned 0x0 [0074.845] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5ac | out: phkResult=0x138e5ac*=0x57c) returned 0x0 [0074.846] RegQueryValueExW (in: hKey=0x57c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x138e5c8, lpData=0x0, lpcbData=0x138e5c4*=0x0 | out: lpType=0x138e5c8*=0x0, lpData=0x0, lpcbData=0x138e5c4*=0x0) returned 0x2 [0074.846] RegCloseKey (hKey=0x57c) returned 0x0 [0074.847] GetCurrentProcessId () returned 0x13d8 [0074.850] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13d8) returned 0x57c [0074.894] EnumProcessModules (in: hProcess=0x57c, lphModule=0x330ef24, cb=0x100, lpcbNeeded=0x138e5b4 | out: lphModule=0x330ef24, lpcbNeeded=0x138e5b4) returned 1 [0074.894] EnumProcessModules (in: hProcess=0x57c, lphModule=0x330f030, cb=0x200, lpcbNeeded=0x138e5b4 | out: lphModule=0x330f030, lpcbNeeded=0x138e5b4) returned 1 [0074.894] GetModuleInformation (in: hProcess=0x57c, hModule=0xfc0000, lpmodinfo=0x330f270, cb=0xc | out: lpmodinfo=0x330f270*(lpBaseOfDll=0xfc0000, SizeOfImage=0x3a000, EntryPoint=0x0)) returned 1 [0074.895] CoTaskMemAlloc (cb=0x804) returned 0x16dc7e0 [0074.895] GetModuleBaseNameW (in: hProcess=0x57c, hModule=0xfc0000, lpBaseName=0x16dc7e0, nSize=0x800 | out: lpBaseName="hidden-tear.exe") returned 0xf [0074.895] CoTaskMemFree (pv=0x16dc7e0) [0074.895] CoTaskMemAlloc (cb=0x804) returned 0x16dc7e0 [0074.895] GetModuleFileNameExW (in: hProcess=0x57c, hModule=0xfc0000, lpFilename=0x16dc7e0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe")) returned 0x27 [0074.895] CoTaskMemFree (pv=0x16dc7e0) [0074.896] CloseHandle (hObject=0x57c) returned 1 [0074.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0074.896] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5ac | out: phkResult=0x138e5ac*=0x0) returned 0x2 [0074.897] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5ac | out: phkResult=0x138e5ac*=0x57c) returned 0x0 [0074.898] RegQueryValueExW (in: hKey=0x57c, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x138e5c8, lpData=0x0, lpcbData=0x138e5c4*=0x0 | out: lpType=0x138e5c8*=0x0, lpData=0x0, lpcbData=0x138e5c4*=0x0) returned 0x2 [0074.898] RegCloseKey (hKey=0x57c) returned 0x0 [0074.898] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5ac | out: phkResult=0x138e5ac*=0x57c) returned 0x0 [0074.899] RegQueryValueExW (in: hKey=0x57c, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x138e5c8, lpData=0x0, lpcbData=0x138e5c4*=0x0 | out: lpType=0x138e5c8*=0x0, lpData=0x0, lpcbData=0x138e5c4*=0x0) returned 0x2 [0074.899] RegCloseKey (hKey=0x57c) returned 0x0 [0074.903] GetCurrentProcessId () returned 0x13d8 [0074.903] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13d8) returned 0x57c [0074.903] EnumProcessModules (in: hProcess=0x57c, lphModule=0x3311ef4, cb=0x100, lpcbNeeded=0x138e5ac | out: lphModule=0x3311ef4, lpcbNeeded=0x138e5ac) returned 1 [0074.903] EnumProcessModules (in: hProcess=0x57c, lphModule=0x3312000, cb=0x200, lpcbNeeded=0x138e5ac | out: lphModule=0x3312000, lpcbNeeded=0x138e5ac) returned 1 [0074.903] GetModuleInformation (in: hProcess=0x57c, hModule=0xfc0000, lpmodinfo=0x3312240, cb=0xc | out: lpmodinfo=0x3312240*(lpBaseOfDll=0xfc0000, SizeOfImage=0x3a000, EntryPoint=0x0)) returned 1 [0074.903] CoTaskMemAlloc (cb=0x804) returned 0x16dc7e0 [0074.903] GetModuleBaseNameW (in: hProcess=0x57c, hModule=0xfc0000, lpBaseName=0x16dc7e0, nSize=0x800 | out: lpBaseName="hidden-tear.exe") returned 0xf [0074.903] CoTaskMemFree (pv=0x16dc7e0) [0074.903] CoTaskMemAlloc (cb=0x804) returned 0x16dc7e0 [0074.903] GetModuleFileNameExW (in: hProcess=0x57c, hModule=0xfc0000, lpFilename=0x16dc7e0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe")) returned 0x27 [0074.904] CoTaskMemFree (pv=0x16dc7e0) [0074.904] CloseHandle (hObject=0x57c) returned 1 [0074.904] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e0a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0074.904] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5a4 | out: phkResult=0x138e5a4*=0x0) returned 0x2 [0074.905] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x138e5a4 | out: phkResult=0x138e5a4*=0x57c) returned 0x0 [0074.905] RegQueryValueExW (in: hKey=0x57c, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x138e5c0, lpData=0x0, lpcbData=0x138e5bc*=0x0 | out: lpType=0x138e5c0*=0x0, lpData=0x0, lpcbData=0x138e5bc*=0x0) returned 0x2 [0074.905] RegCloseKey (hKey=0x57c) returned 0x0 [0074.910] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x16b0658 [0075.652] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x16b0658, dwGroupId=0x0) returned 0x0 [0075.675] LocalFree (hMem=0x16b0658) returned 0x0 [0075.675] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x16d9b68 [0075.675] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x16d9b68, dwGroupId=0x0) returned 0x0 [0075.675] LocalFree (hMem=0x16d9b68) returned 0x0 [0075.811] EnumerateSecurityPackagesW (in: pcPackages=0x138e5e8, ppPackageInfo=0x138e57c | out: pcPackages=0x138e5e8, ppPackageInfo=0x138e57c) returned 0x0 [0076.064] FreeContextBuffer (in: pvContextBuffer=0x16e24a8 | out: pvContextBuffer=0x16e24a8) returned 0x0 [0076.069] GetCurrentProcess () returned 0xffffffff [0076.069] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x138e3ac | out: TokenHandle=0x138e3ac*=0x5c8) returned 1 [0076.070] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x3314900, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x138e400, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x33160ac, ptsExpiry=0x138e384 | out: phCredential=0x33160ac, ptsExpiry=0x138e384) returned 0x0 [0076.401] InitializeSecurityContextW (in: phCredential=0x138e3c0, phContext=0x0, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x3316248, pfContextAttr=0x33148d4, ptsExpiry=0x138e3b8 | out: phNewContext=0x33162b0, pOutput=0x3316248, pfContextAttr=0x33148d4, ptsExpiry=0x138e3b8) returned 0x90312 [0076.402] FreeContextBuffer (in: pvContextBuffer=0x840d6a0 | out: pvContextBuffer=0x840d6a0) returned 0x0 [0076.406] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0076.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x138e400, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatãâq\x82\x94\x87_ðù°sHë8\x01\x01", lpUsedDefaultChar=0x0) returned 21 [0076.406] GetProcAddress (hModule=0x772d0000, lpProcName="AppPolicyGetClrCompat") returned 0x74c968b0 [0076.412] AppPolicyGetClrCompat () returned 0x0 [0076.413] send (s=0x5a4, buf=0x33162c4*, len=122, flags=0) returned 122 [0076.417] recv (in: s=0x5a4, buf=0x33162c4, len=5, flags=0 | out: buf=0x33162c4*) returned 5 [0076.440] recv (in: s=0x5a4, buf=0x33162c9, len=63, flags=0 | out: buf=0x33162c9*) returned 63 [0076.440] InitializeSecurityContextW (in: phCredential=0x138e318, phContext=0x138e3a8, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x331669c, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x33166b0, pfContextAttr=0x33148d4, ptsExpiry=0x138e310 | out: phNewContext=0x33162b0, pOutput=0x33166b0, pfContextAttr=0x33148d4, ptsExpiry=0x138e310) returned 0x90312 [0076.441] recv (in: s=0x5a4, buf=0x3316740, len=5, flags=0 | out: buf=0x3316740*) returned 5 [0076.441] recv (in: s=0x5a4, buf=0x3316759, len=2343, flags=0 | out: buf=0x3316759*) returned 2343 [0076.441] InitializeSecurityContextW (in: phCredential=0x138e274, phContext=0x138e304, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x33170f0, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x3317104, pfContextAttr=0x33148d4, ptsExpiry=0x138e26c | out: phNewContext=0x33162b0, pOutput=0x3317104, pfContextAttr=0x33148d4, ptsExpiry=0x138e26c) returned 0x90312 [0076.446] recv (in: s=0x5a4, buf=0x3317194, len=5, flags=0 | out: buf=0x3317194*) returned 5 [0076.447] recv (in: s=0x5a4, buf=0x33171ad, len=113, flags=0 | out: buf=0x33171ad*) returned 113 [0076.447] InitializeSecurityContextW (in: phCredential=0x138e1d0, phContext=0x138e260, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3317290, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x33172a4, pfContextAttr=0x33148d4, ptsExpiry=0x138e1c8 | out: phNewContext=0x33162b0, pOutput=0x33172a4, pfContextAttr=0x33148d4, ptsExpiry=0x138e1c8) returned 0x90312 [0076.447] recv (in: s=0x5a4, buf=0x3317334, len=5, flags=0 | out: buf=0x3317334*) returned 5 [0076.447] recv (in: s=0x5a4, buf=0x331734d, len=4, flags=0 | out: buf=0x331734d*) returned 4 [0076.447] InitializeSecurityContextW (in: phCredential=0x138e12c, phContext=0x138e1bc, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x33173c4, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x33173d8, pfContextAttr=0x33148d4, ptsExpiry=0x138e124 | out: phNewContext=0x33162b0, pOutput=0x33173d8, pfContextAttr=0x33148d4, ptsExpiry=0x138e124) returned 0x90312 [0076.475] FreeContextBuffer (in: pvContextBuffer=0x8401a80 | out: pvContextBuffer=0x8401a80) returned 0x0 [0076.475] send (s=0x5a4, buf=0x3317454*, len=101, flags=0) returned 101 [0076.475] recv (in: s=0x5a4, buf=0x3317454, len=5, flags=0 | out: buf=0x3317454*) returned 5 [0076.489] recv (in: s=0x5a4, buf=0x33174e1, len=236, flags=0 | out: buf=0x33174e1*) returned 236 [0076.489] InitializeSecurityContextW (in: phCredential=0x138e088, phContext=0x138e118, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3317640, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x3317654, pfContextAttr=0x33148d4, ptsExpiry=0x138e080 | out: phNewContext=0x33162b0, pOutput=0x3317654, pfContextAttr=0x33148d4, ptsExpiry=0x138e080) returned 0x90312 [0076.489] recv (in: s=0x5a4, buf=0x33176e4, len=5, flags=0 | out: buf=0x33176e4*) returned 5 [0076.490] recv (in: s=0x5a4, buf=0x33176fd, len=1, flags=0 | out: buf=0x33176fd*) returned 1 [0076.490] InitializeSecurityContextW (in: phCredential=0x138dfe4, phContext=0x138e074, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3317770, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x3317784, pfContextAttr=0x33148d4, ptsExpiry=0x138dfdc | out: phNewContext=0x33162b0, pOutput=0x3317784, pfContextAttr=0x33148d4, ptsExpiry=0x138dfdc) returned 0x90312 [0076.490] recv (in: s=0x5a4, buf=0x3317814, len=5, flags=0 | out: buf=0x3317814*) returned 5 [0076.490] recv (in: s=0x5a4, buf=0x331782d, len=48, flags=0 | out: buf=0x331782d*) returned 48 [0076.490] InitializeSecurityContextW (in: phCredential=0x138df40, phContext=0x138dfd0, pTargetName=0x330c8ec, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x33178d0, Reserved2=0x0, phNewContext=0x33162b0, pOutput=0x33178e4, pfContextAttr=0x33148d4, ptsExpiry=0x138df38 | out: phNewContext=0x33162b0, pOutput=0x33178e4, pfContextAttr=0x33148d4, ptsExpiry=0x138df38) returned 0x0 [0077.369] QueryContextAttributesW (in: phContext=0x33162b0, ulAttribute=0x4, pBuffer=0x3317990 | out: pBuffer=0x3317990) returned 0x0 [0077.369] QueryContextAttributesW (in: phContext=0x33162b0, ulAttribute=0x5a, pBuffer=0x33179e8 | out: pBuffer=0x33179e8) returned 0x0 [0077.370] QueryContextAttributesW (in: phContext=0x33162b0, ulAttribute=0x53, pBuffer=0x3317a94 | out: pBuffer=0x3317a94) returned 0x0 [0077.378] CertDuplicateCertificateContext (pCertContext=0x16e18c0) returned 0x16e18c0 [0077.378] CertDuplicateStore (hCertStore=0x16d9520) returned 0x16d9520 [0077.379] CertEnumCertificatesInStore (hCertStore=0x16d9520, pPrevCertContext=0x0) returned 0x16e15f0 [0077.379] CertDuplicateCertificateContext (pCertContext=0x16e15f0) returned 0x16e15f0 [0077.379] CertEnumCertificatesInStore (hCertStore=0x16d9520, pPrevCertContext=0x16e15f0) returned 0x16e18c0 [0077.379] CertDuplicateCertificateContext (pCertContext=0x16e18c0) returned 0x16e18c0 [0077.379] CertEnumCertificatesInStore (hCertStore=0x16d9520, pPrevCertContext=0x16e18c0) returned 0x0 [0077.379] CertCloseStore (hCertStore=0x16d9520, dwFlags=0x0) returned 1 [0077.379] CertFreeCertificateContext (pCertContext=0x16e18c0) returned 1 [0077.391] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x16d91d8 [0077.392] CertAddCRLLinkToStore (in: hCertStore=0x16d91d8, pCrlContext=0x16e15f0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0077.393] CertAddCRLLinkToStore (in: hCertStore=0x16d91d8, pCrlContext=0x16e18c0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0077.393] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x16e4078 [0077.397] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x16e18c0, pTime=0x138df50, hAdditionalStore=0x16d91d8, pChainPara=0x138de90, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x138de84 | out: ppChainContext=0x138de84) returned 1 [0077.583] LocalFree (hMem=0x16e4078) returned 0x0 [0077.583] CertDuplicateCertificateChain (pChainContext=0x170ba28) returned 0x170ba28 [0077.583] CertDuplicateCertificateContext (pCertContext=0x16e18c0) returned 0x16e18c0 [0077.584] CertDuplicateCertificateContext (pCertContext=0x16e1820) returned 0x16e1820 [0077.584] CertDuplicateCertificateContext (pCertContext=0x16e1d70) returned 0x16e1d70 [0077.584] CertFreeCertificateChain (pChainContext=0x170ba28) [0077.584] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x170ba28, pPolicyPara=0x138e030, pPolicyStatus=0x138e01c | out: pPolicyStatus=0x138e01c) returned 1 [0077.585] SetLastError (dwErrCode=0x0) [0077.587] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x170ba28, pPolicyPara=0x138e090, pPolicyStatus=0x138e044 | out: pPolicyStatus=0x138e044) returned 1 [0077.592] CertFreeCertificateChain (pChainContext=0x170ba28) [0077.592] CertFreeCertificateContext (pCertContext=0x16e18c0) returned 1 [0077.595] CoTaskMemAlloc (cb=0x20e) returned 0x170ba28 [0077.595] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x170ba28, nSize=0x105 | out: lpBuffer="ᕐűאűĀ") returned 0x0 [0077.595] CoTaskMemFree (pv=0x170ba28) [0077.595] CoTaskMemAlloc (cb=0x20e) returned 0x170ba28 [0077.595] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x170ba28, nSize=0x105 | out: lpBuffer="ᕐűאűĀ") returned 0x0 [0077.595] CoTaskMemFree (pv=0x170ba28) [0077.595] CoTaskMemAlloc (cb=0x20e) returned 0x170ba28 [0077.595] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x170ba28, nSize=0x105 | out: lpBuffer="ᕐűאűĀ") returned 0x0 [0077.595] CoTaskMemFree (pv=0x170ba28) [0077.595] CoTaskMemAlloc (cb=0x20e) returned 0x170ba28 [0077.595] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x170ba28, nSize=0x105 | out: lpBuffer="ᕐűאűĀ") returned 0x0 [0077.595] CoTaskMemFree (pv=0x170ba28) [0077.596] EncryptMessage (in: phContext=0x33162b0, fQOP=0x0, pMessage=0x331fbd8, MessageSeqNo=0x0 | out: pMessage=0x331fbd8) returned 0x0 [0077.597] send (s=0x5a4, buf=0x331e6b0*, len=138, flags=0) returned 138 [0077.598] setsockopt (s=0x5a4, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0077.599] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.661] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.662] DecryptMessage (in: phContext=0x33162b0, pMessage=0x332ffa8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x332ffa8, pfQOP=0x0) returned 0x0 [0077.671] setsockopt (s=0x5a4, level=65535, optname=4102, optval="ô\x01", optlen=4) returned 0 [0077.672] QueryPerformanceCounter (in: lpPerformanceCount=0x138e930 | out: lpPerformanceCount=0x138e930*=17345154599) returned 1 [0077.672] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345160112) returned 1 [0077.677] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.677] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.677] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33338a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33338a4, pfQOP=0x0) returned 0x0 [0077.677] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345736916) returned 1 [0077.677] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.678] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.678] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33339c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33339c4, pfQOP=0x0) returned 0x0 [0077.678] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345761888) returned 1 [0077.678] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.678] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.678] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3333ae4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3333ae4, pfQOP=0x0) returned 0x0 [0077.678] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345786168) returned 1 [0077.678] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.678] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.678] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3333c04, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3333c04, pfQOP=0x0) returned 0x0 [0077.678] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345808735) returned 1 [0077.678] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.678] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.678] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3333d24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3333d24, pfQOP=0x0) returned 0x0 [0077.678] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345831349) returned 1 [0077.679] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.679] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.679] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3333e44, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3333e44, pfQOP=0x0) returned 0x0 [0077.679] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345900296) returned 1 [0077.679] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.679] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.679] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3333f64, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3333f64, pfQOP=0x0) returned 0x0 [0077.679] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345922918) returned 1 [0077.679] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.679] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.679] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334084, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334084, pfQOP=0x0) returned 0x0 [0077.680] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345946379) returned 1 [0077.680] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.680] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.680] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33341a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33341a4, pfQOP=0x0) returned 0x0 [0077.680] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345968836) returned 1 [0077.680] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.680] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.680] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33342c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33342c4, pfQOP=0x0) returned 0x0 [0077.680] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17345991454) returned 1 [0077.681] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.681] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.681] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33343e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33343e4, pfQOP=0x0) returned 0x0 [0077.681] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346074620) returned 1 [0077.681] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.681] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.681] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334504, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334504, pfQOP=0x0) returned 0x0 [0077.681] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346101744) returned 1 [0077.681] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.681] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.681] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334624, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334624, pfQOP=0x0) returned 0x0 [0077.681] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346124829) returned 1 [0077.681] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.681] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.681] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334744, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334744, pfQOP=0x0) returned 0x0 [0077.682] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346194790) returned 1 [0077.682] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.682] recv (in: s=0x5a4, buf=0x332beed, len=608, flags=0 | out: buf=0x332beed*) returned 608 [0077.682] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334864, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334864, pfQOP=0x0) returned 0x0 [0077.682] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346223303) returned 1 [0077.682] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.683] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.683] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334984, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334984, pfQOP=0x0) returned 0x0 [0077.683] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346263124) returned 1 [0077.683] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.683] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.683] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334aa4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334aa4, pfQOP=0x0) returned 0x0 [0077.683] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346285661) returned 1 [0077.683] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.683] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.683] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334bc4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334bc4, pfQOP=0x0) returned 0x0 [0077.683] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346339051) returned 1 [0077.684] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.684] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.684] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334ce4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334ce4, pfQOP=0x0) returned 0x0 [0077.684] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346614719) returned 1 [0077.687] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.687] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.687] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334e04, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334e04, pfQOP=0x0) returned 0x0 [0077.687] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346741726) returned 1 [0077.688] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.688] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.688] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3334f24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3334f24, pfQOP=0x0) returned 0x0 [0077.688] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346764324) returned 1 [0077.688] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.688] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.688] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335044, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335044, pfQOP=0x0) returned 0x0 [0077.688] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346831424) returned 1 [0077.688] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.688] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.689] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335164, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335164, pfQOP=0x0) returned 0x0 [0077.689] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346854855) returned 1 [0077.689] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.689] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.689] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335284, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335284, pfQOP=0x0) returned 0x0 [0077.689] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346880804) returned 1 [0077.689] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.689] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.689] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33353a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33353a4, pfQOP=0x0) returned 0x0 [0077.689] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346936214) returned 1 [0077.690] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.690] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.690] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33354c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33354c4, pfQOP=0x0) returned 0x0 [0077.690] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346969610) returned 1 [0077.690] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.690] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.690] DecryptMessage (in: phContext=0x33162b0, pMessage=0x33355e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33355e4, pfQOP=0x0) returned 0x0 [0077.690] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17346993577) returned 1 [0077.690] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.690] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.690] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335704, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335704, pfQOP=0x0) returned 0x0 [0077.690] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347015921) returned 1 [0077.690] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.690] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.690] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335824, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335824, pfQOP=0x0) returned 0x0 [0077.690] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347038353) returned 1 [0077.690] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.691] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.691] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335944, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335944, pfQOP=0x0) returned 0x0 [0077.691] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347060697) returned 1 [0077.691] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.691] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.691] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335a64, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335a64, pfQOP=0x0) returned 0x0 [0077.691] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347083145) returned 1 [0077.691] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.691] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.691] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335b84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335b84, pfQOP=0x0) returned 0x0 [0077.691] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347105576) returned 1 [0077.691] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.691] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.691] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335ca4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335ca4, pfQOP=0x0) returned 0x0 [0077.691] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347127999) returned 1 [0077.691] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.691] recv (in: s=0x5a4, buf=0x332beed, len=1424, flags=0 | out: buf=0x332beed*) returned 1424 [0077.692] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335dc4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335dc4, pfQOP=0x0) returned 0x0 [0077.692] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347150354) returned 1 [0077.692] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.692] recv (in: s=0x5a4, buf=0x332beed, len=896, flags=0 | out: buf=0x332beed*) returned 896 [0077.692] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3335ee4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3335ee4, pfQOP=0x0) returned 0x0 [0077.692] QueryPerformanceCounter (in: lpPerformanceCount=0x138e8f8 | out: lpPerformanceCount=0x138e8f8*=17347172734) returned 1 [0077.692] recv (in: s=0x5a4, buf=0x332bee8, len=5, flags=0 | out: buf=0x332bee8*) returned 5 [0077.692] recv (in: s=0x5a4, buf=0x332beed, len=32, flags=0 | out: buf=0x332beed*) returned 32 [0077.692] DecryptMessage (in: phContext=0x33162b0, pMessage=0x3336004, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3336004, pfQOP=0x0) returned 0x0 [0077.692] SetEvent (hEvent=0x2e8) returned 1 [0077.692] QueryPerformanceCounter (in: lpPerformanceCount=0x138e91c | out: lpPerformanceCount=0x138e91c*=17347207829) returned 1 [0077.698] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ransom.jpg", nBufferLength=0x105, lpBuffer=0x138e37c, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ransom.jpg", lpFilePart=0x0) returned 0x14 [0077.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138e8c0) returned 1 [0077.699] CreateFileW (lpFileName="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6a4 [0077.700] GetFileType (hFile=0x6a4) returned 0x1 [0077.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138e8bc) returned 1 [0077.700] GetFileType (hFile=0x6a4) returned 0x1 [0077.700] QueryPerformanceCounter (in: lpPerformanceCount=0x138e944 | out: lpPerformanceCount=0x138e944*=17348032134) returned 1 [0077.701] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x16b15cc*=0x6ac, lpdwindex=0x138e5d4 | out: lpdwindex=0x138e5d4) returned 0x0 [0077.701] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0077.702] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0077.703] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0077.783] BeginPaint (in: hWnd=0x6002e, lpPaint=0x138df18 | out: lpPaint=0x138df18) returned 0xf0105ee [0077.783] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138dbf4 | out: lpwndpl=0x138dbf4) returned 1 [0077.784] GetClientRect (in: hWnd=0x6002e, lpRect=0x138dba0 | out: lpRect=0x138dba0) returned 1 [0077.784] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0077.784] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0077.784] GetSystemMetrics (nIndex=42) returned 0 [0077.784] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138da60, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0077.784] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138da60) returned 0xb [0077.784] GetClientRect (in: hWnd=0x6002e, lpRect=0x138daa8 | out: lpRect=0x138daa8) returned 1 [0077.784] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0077.784] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0077.784] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0xffffffffaa050796 [0077.784] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0077.784] SaveDC (hdc=0xf0105ee) returned 1 [0077.784] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0077.785] CreateSolidBrush (color=0xf0f0f0) returned 0x58100798 [0077.785] FillRect (hDC=0xf0105ee, lprc=0x138d948, hbr=0x58100798) returned 1 [0077.785] DeleteObject (ho=0x58100798) returned 1 [0077.785] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0077.786] GdipCreateHalftonePalette () returned 0x2008078b [0077.787] SelectPalette (hdc=0xf0105ee, hPal=0x2008078b, bForceBkgd=1) returned 0x88000b [0077.787] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0077.787] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0077.787] GetSystemMetrics (nIndex=42) returned 0 [0077.787] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138dea8, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0077.787] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138dea8) returned 0xb [0077.787] SelectPalette (hdc=0xf0105ee, hPal=0x88000b, bForceBkgd=0) returned 0x2008078b [0077.787] EndPaint (hWnd=0x6002e, lpPaint=0x138df14) returned 1 [0077.788] SetEvent (hEvent=0x2e8) returned 1 [0077.788] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e74c*=0x494, lpdwindex=0x138e56c | out: lpdwindex=0x138e56c) returned 0x80010115 [0077.789] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e72c*=0x484, lpdwindex=0x138e54c | out: lpdwindex=0x138e54c) returned 0x80010115 [0077.789] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e72c*=0x48c, lpdwindex=0x138e54c | out: lpdwindex=0x138e54c) returned 0x80010115 [0077.789] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e780*=0x4b4, lpdwindex=0x138e59c | out: lpdwindex=0x138e59c) returned 0x80010115 [0077.790] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e780*=0x4bc, lpdwindex=0x138e59c | out: lpdwindex=0x138e59c) returned 0x80010115 [0077.790] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e780*=0x4c4, lpdwindex=0x138e59c | out: lpdwindex=0x138e59c) returned 0x80010115 [0077.791] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6b0 [0077.791] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6b4 [0077.791] GetAddrInfoW (in: pNodeName="i.imgur.com", pServiceName=0x0, pHints=0x138e680*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x138e628 | out: ppResult=0x138e628*=0x16e1060*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ipv4.imgur.map.fastly.net", ai_addr=0x16e32e0*(sa_family=2, sin_port=0x0, sin_addr="151.101.112.193"), ai_next=0x0)) returned 0 [0077.797] FreeAddrInfoW (pAddrInfo=0x16e1060*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ipv4.imgur.map.fastly.net", ai_addr=0x16e32e0*(sa_family=2, sin_port=0x0, sin_addr="151.101.112.193"), ai_next=0x0)) [0077.797] GetAddrInfoW (in: pNodeName="i.imgur.com", pServiceName=0x0, pHints=0x138e680*(ai_flags=131072, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x138e628 | out: ppResult=0x138e628*=0x16e0ef8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="i.imgur.com", ai_addr=0x16e32e0*(sa_family=2, sin_port=0x0, sin_addr="151.101.112.193"), ai_next=0x0)) returned 0 [0077.799] FreeAddrInfoW (pAddrInfo=0x16e0ef8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="i.imgur.com", ai_addr=0x16e32e0*(sa_family=2, sin_port=0x0, sin_addr="151.101.112.193"), ai_next=0x0)) [0077.799] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e5c4*=0x5b4, lpdwindex=0x138e3e4 | out: lpdwindex=0x138e3e4) returned 0x80010115 [0077.799] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e5c4*=0x5bc, lpdwindex=0x138e3e4 | out: lpdwindex=0x138e3e4) returned 0x80010115 [0077.800] WSAConnect (in: s=0x6b0, name=0x3348aa8*(sa_family=2, sin_port=0x1bb, sin_addr="151.101.112.193"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0077.819] closesocket (s=0x6b4) returned 0 [0077.819] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x16e89b0 [0077.819] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x16e89b0, dwGroupId=0x0) returned 0x0 [0077.820] LocalFree (hMem=0x16e89b0) returned 0x0 [0077.820] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x16e8980 [0077.820] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x16e8980, dwGroupId=0x0) returned 0x0 [0077.820] LocalFree (hMem=0x16e8980) returned 0x0 [0077.820] InitializeSecurityContextW (in: phCredential=0x138e3a0, phContext=0x0, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x33490ec, pfContextAttr=0x3348f34, ptsExpiry=0x138e398 | out: phNewContext=0x3349154, pOutput=0x33490ec, pfContextAttr=0x3348f34, ptsExpiry=0x138e398) returned 0x90312 [0077.821] FreeContextBuffer (in: pvContextBuffer=0x8400600 | out: pvContextBuffer=0x8400600) returned 0x0 [0077.821] send (s=0x6b0, buf=0x3349168*, len=119, flags=0) returned 119 [0077.821] recv (in: s=0x6b0, buf=0x3349168, len=5, flags=0 | out: buf=0x3349168*) returned 5 [0077.840] recv (in: s=0x6b0, buf=0x334916d, len=69, flags=0 | out: buf=0x334916d*) returned 69 [0077.840] InitializeSecurityContextW (in: phCredential=0x138e2f8, phContext=0x138e388, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3349264, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x3349278, pfContextAttr=0x3348f34, ptsExpiry=0x138e2f0 | out: phNewContext=0x3349154, pOutput=0x3349278, pfContextAttr=0x3348f34, ptsExpiry=0x138e2f0) returned 0x90312 [0077.841] recv (in: s=0x6b0, buf=0x3349308, len=5, flags=0 | out: buf=0x3349308*) returned 5 [0077.841] recv (in: s=0x6b0, buf=0x3349321, len=2886, flags=0 | out: buf=0x3349321*) returned 2886 [0077.841] InitializeSecurityContextW (in: phCredential=0x138e254, phContext=0x138e2e4, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3349ed8, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x3349eec, pfContextAttr=0x3348f34, ptsExpiry=0x138e24c | out: phNewContext=0x3349154, pOutput=0x3349eec, pfContextAttr=0x3348f34, ptsExpiry=0x138e24c) returned 0x90312 [0077.842] recv (in: s=0x6b0, buf=0x3349f7c, len=5, flags=0 | out: buf=0x3349f7c*) returned 5 [0077.842] recv (in: s=0x6b0, buf=0x3349f95, len=298, flags=0 | out: buf=0x3349f95*) returned 298 [0077.842] InitializeSecurityContextW (in: phCredential=0x138e1b0, phContext=0x138e240, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x334a130, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x334a144, pfContextAttr=0x3348f34, ptsExpiry=0x138e1a8 | out: phNewContext=0x3349154, pOutput=0x334a144, pfContextAttr=0x3348f34, ptsExpiry=0x138e1a8) returned 0x90312 [0077.843] recv (in: s=0x6b0, buf=0x334a1d4, len=5, flags=0 | out: buf=0x334a1d4*) returned 5 [0077.843] recv (in: s=0x6b0, buf=0x334a1ed, len=4, flags=0 | out: buf=0x334a1ed*) returned 4 [0077.843] InitializeSecurityContextW (in: phCredential=0x138e10c, phContext=0x138e19c, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x334a264, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x334a278, pfContextAttr=0x3348f34, ptsExpiry=0x138e104 | out: phNewContext=0x3349154, pOutput=0x334a278, pfContextAttr=0x3348f34, ptsExpiry=0x138e104) returned 0x90312 [0078.063] FreeContextBuffer (in: pvContextBuffer=0x8401a80 | out: pvContextBuffer=0x8401a80) returned 0x0 [0078.063] send (s=0x6b0, buf=0x334a2f4*, len=101, flags=0) returned 101 [0078.064] recv (in: s=0x6b0, buf=0x334a2f4, len=5, flags=0 | out: buf=0x334a2f4*) returned 5 [0078.077] recv (in: s=0x6b0, buf=0x334a381, len=186, flags=0 | out: buf=0x334a381*) returned 186 [0078.077] InitializeSecurityContextW (in: phCredential=0x138e068, phContext=0x138e0f8, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x334a4ac, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x334a4c0, pfContextAttr=0x3348f34, ptsExpiry=0x138e060 | out: phNewContext=0x3349154, pOutput=0x334a4c0, pfContextAttr=0x3348f34, ptsExpiry=0x138e060) returned 0x90312 [0078.078] recv (in: s=0x6b0, buf=0x334a550, len=5, flags=0 | out: buf=0x334a550*) returned 5 [0078.078] recv (in: s=0x6b0, buf=0x334a569, len=1, flags=0 | out: buf=0x334a569*) returned 1 [0078.078] InitializeSecurityContextW (in: phCredential=0x138dfc4, phContext=0x138e054, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x334a5dc, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x334a5f0, pfContextAttr=0x3348f34, ptsExpiry=0x138dfbc | out: phNewContext=0x3349154, pOutput=0x334a5f0, pfContextAttr=0x3348f34, ptsExpiry=0x138dfbc) returned 0x90312 [0078.078] recv (in: s=0x6b0, buf=0x334a680, len=5, flags=0 | out: buf=0x334a680*) returned 5 [0078.078] recv (in: s=0x6b0, buf=0x334a699, len=48, flags=0 | out: buf=0x334a699*) returned 48 [0078.078] InitializeSecurityContextW (in: phCredential=0x138df20, phContext=0x138dfb0, pTargetName=0x3348af0, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x334a73c, Reserved2=0x0, phNewContext=0x3349154, pOutput=0x334a750, pfContextAttr=0x3348f34, ptsExpiry=0x138df18 | out: phNewContext=0x3349154, pOutput=0x334a750, pfContextAttr=0x3348f34, ptsExpiry=0x138df18) returned 0x0 [0078.080] QueryContextAttributesW (in: phContext=0x3349154, ulAttribute=0x4, pBuffer=0x334a7e0 | out: pBuffer=0x334a7e0) returned 0x0 [0078.080] QueryContextAttributesW (in: phContext=0x3349154, ulAttribute=0x5a, pBuffer=0x334a81c | out: pBuffer=0x334a81c) returned 0x0 [0078.080] QueryContextAttributesW (in: phContext=0x3349154, ulAttribute=0x53, pBuffer=0x334a868 | out: pBuffer=0x334a868) returned 0x0 [0078.080] CertDuplicateCertificateContext (pCertContext=0x16e17d0) returned 0x16e17d0 [0078.080] CertDuplicateStore (hCertStore=0x16eb498) returned 0x16eb498 [0078.080] CertEnumCertificatesInStore (hCertStore=0x16eb498, pPrevCertContext=0x0) returned 0x16e1910 [0078.080] CertDuplicateCertificateContext (pCertContext=0x16e1910) returned 0x16e1910 [0078.080] CertEnumCertificatesInStore (hCertStore=0x16eb498, pPrevCertContext=0x16e1910) returned 0x16e17d0 [0078.080] CertDuplicateCertificateContext (pCertContext=0x16e17d0) returned 0x16e17d0 [0078.080] CertEnumCertificatesInStore (hCertStore=0x16eb498, pPrevCertContext=0x16e17d0) returned 0x0 [0078.080] CertCloseStore (hCertStore=0x16eb498, dwFlags=0x0) returned 1 [0078.080] CertFreeCertificateContext (pCertContext=0x16e17d0) returned 1 [0078.081] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x16eaf70 [0078.081] CertAddCRLLinkToStore (in: hCertStore=0x16eaf70, pCrlContext=0x16e1910, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0078.081] CertAddCRLLinkToStore (in: hCertStore=0x16eaf70, pCrlContext=0x16e17d0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0078.081] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x16e4118 [0078.081] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x16e17d0, pTime=0x138df30, hAdditionalStore=0x16eaf70, pChainPara=0x138de70, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x138de64 | out: ppChainContext=0x138de64) returned 1 [0078.084] LocalFree (hMem=0x16e4118) returned 0x0 [0078.084] CertDuplicateCertificateChain (pChainContext=0x1713e60) returned 0x1713e60 [0078.084] CertDuplicateCertificateContext (pCertContext=0x16e17d0) returned 0x16e17d0 [0078.084] CertDuplicateCertificateContext (pCertContext=0x16e1500) returned 0x16e1500 [0078.084] CertDuplicateCertificateContext (pCertContext=0x16e1960) returned 0x16e1960 [0078.084] CertFreeCertificateChain (pChainContext=0x1713e60) [0078.084] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1713e60, pPolicyPara=0x138e010, pPolicyStatus=0x138dffc | out: pPolicyStatus=0x138dffc) returned 1 [0078.084] SetLastError (dwErrCode=0x0) [0078.084] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1713e60, pPolicyPara=0x138e070, pPolicyStatus=0x138e024 | out: pPolicyStatus=0x138e024) returned 1 [0078.084] CertFreeCertificateChain (pChainContext=0x1713e60) [0078.084] CertFreeCertificateContext (pCertContext=0x16e17d0) returned 1 [0078.085] EncryptMessage (in: phContext=0x3349154, fQOP=0x0, pMessage=0x3360410, MessageSeqNo=0x0 | out: pMessage=0x3360410) returned 0x0 [0078.085] send (s=0x6b0, buf=0x331d298*, len=138, flags=0) returned 138 [0078.085] setsockopt (s=0x6b0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0078.086] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.135] recv (in: s=0x6b0, buf=0x3327eb5, len=656, flags=0 | out: buf=0x3327eb5*) returned 656 [0078.135] DecryptMessage (in: phContext=0x3349154, pMessage=0x33a0930, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33a0930, pfQOP=0x0) returned 0x0 [0078.137] setsockopt (s=0x6b0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0078.137] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.137] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.138] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b173c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b173c, pfQOP=0x0) returned 0x0 [0078.138] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.138] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.138] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b285c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b285c, pfQOP=0x0) returned 0x0 [0078.138] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.138] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.139] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2970, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2970, pfQOP=0x0) returned 0x0 [0078.139] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.140] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.140] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.140] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2a84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2a84, pfQOP=0x0) returned 0x0 [0078.141] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.141] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.141] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2b98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2b98, pfQOP=0x0) returned 0x0 [0078.141] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.141] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.141] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2cac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2cac, pfQOP=0x0) returned 0x0 [0078.141] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.141] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.141] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.141] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2dc0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2dc0, pfQOP=0x0) returned 0x0 [0078.141] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.141] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.141] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2ed4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2ed4, pfQOP=0x0) returned 0x0 [0078.142] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.142] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.142] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b2fe8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b2fe8, pfQOP=0x0) returned 0x0 [0078.142] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.142] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.142] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.142] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b30fc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b30fc, pfQOP=0x0) returned 0x0 [0078.142] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.142] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.142] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3210, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3210, pfQOP=0x0) returned 0x0 [0078.142] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.142] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.142] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3324, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3324, pfQOP=0x0) returned 0x0 [0078.143] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.143] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.143] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.143] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3438, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3438, pfQOP=0x0) returned 0x0 [0078.143] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.143] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.143] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b354c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b354c, pfQOP=0x0) returned 0x0 [0078.143] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.143] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.143] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3660, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3660, pfQOP=0x0) returned 0x0 [0078.143] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.143] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.144] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.144] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3774, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3774, pfQOP=0x0) returned 0x0 [0078.144] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.144] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.144] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3888, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3888, pfQOP=0x0) returned 0x0 [0078.144] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.144] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.144] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b399c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b399c, pfQOP=0x0) returned 0x0 [0078.144] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.144] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.144] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.144] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3ab0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3ab0, pfQOP=0x0) returned 0x0 [0078.144] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.144] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.145] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3bc4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3bc4, pfQOP=0x0) returned 0x0 [0078.145] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.145] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.145] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3cd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3cd8, pfQOP=0x0) returned 0x0 [0078.145] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.145] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.145] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.145] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3dec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3dec, pfQOP=0x0) returned 0x0 [0078.145] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.145] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.145] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b3f00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b3f00, pfQOP=0x0) returned 0x0 [0078.145] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.145] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.145] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4014, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4014, pfQOP=0x0) returned 0x0 [0078.146] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.146] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.146] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.146] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4128, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4128, pfQOP=0x0) returned 0x0 [0078.146] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.146] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.146] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b423c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b423c, pfQOP=0x0) returned 0x0 [0078.146] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.146] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.146] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4350, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4350, pfQOP=0x0) returned 0x0 [0078.146] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.146] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.146] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.147] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4464, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4464, pfQOP=0x0) returned 0x0 [0078.147] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.147] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.147] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4578, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4578, pfQOP=0x0) returned 0x0 [0078.147] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.147] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.147] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b468c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b468c, pfQOP=0x0) returned 0x0 [0078.147] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.147] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.147] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.147] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b47a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b47a0, pfQOP=0x0) returned 0x0 [0078.147] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.147] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.148] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b48b4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b48b4, pfQOP=0x0) returned 0x0 [0078.148] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.148] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.148] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b49c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b49c8, pfQOP=0x0) returned 0x0 [0078.148] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.148] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.148] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.148] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4adc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4adc, pfQOP=0x0) returned 0x0 [0078.148] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.148] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.148] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4bf0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4bf0, pfQOP=0x0) returned 0x0 [0078.148] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.148] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.148] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4d04, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4d04, pfQOP=0x0) returned 0x0 [0078.149] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.149] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.149] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.149] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4e18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4e18, pfQOP=0x0) returned 0x0 [0078.149] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.149] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.149] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b4f2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b4f2c, pfQOP=0x0) returned 0x0 [0078.149] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.149] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.149] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5040, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5040, pfQOP=0x0) returned 0x0 [0078.149] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.149] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.150] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.150] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5154, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5154, pfQOP=0x0) returned 0x0 [0078.150] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.150] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.150] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5268, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5268, pfQOP=0x0) returned 0x0 [0078.150] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.150] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.150] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b537c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b537c, pfQOP=0x0) returned 0x0 [0078.150] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.150] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.150] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.150] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5490, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5490, pfQOP=0x0) returned 0x0 [0078.150] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.150] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.150] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b55a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b55a4, pfQOP=0x0) returned 0x0 [0078.151] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.151] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.151] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b56b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b56b8, pfQOP=0x0) returned 0x0 [0078.151] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.152] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.152] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.152] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b57cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b57cc, pfQOP=0x0) returned 0x0 [0078.152] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.152] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.152] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b58e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b58e0, pfQOP=0x0) returned 0x0 [0078.152] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.152] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.152] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b59f4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b59f4, pfQOP=0x0) returned 0x0 [0078.152] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.153] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.153] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.153] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5b08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5b08, pfQOP=0x0) returned 0x0 [0078.153] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.153] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.153] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5c1c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5c1c, pfQOP=0x0) returned 0x0 [0078.153] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.153] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.153] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5d30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5d30, pfQOP=0x0) returned 0x0 [0078.160] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.173] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.174] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.174] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5e44, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5e44, pfQOP=0x0) returned 0x0 [0078.174] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.174] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.174] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b5f58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b5f58, pfQOP=0x0) returned 0x0 [0078.174] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.174] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.174] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b606c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b606c, pfQOP=0x0) returned 0x0 [0078.174] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.175] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.175] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.177] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6180, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6180, pfQOP=0x0) returned 0x0 [0078.177] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.177] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.177] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6294, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6294, pfQOP=0x0) returned 0x0 [0078.177] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.177] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.177] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b63a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b63a8, pfQOP=0x0) returned 0x0 [0078.177] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.177] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.177] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.177] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b64bc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b64bc, pfQOP=0x0) returned 0x0 [0078.178] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.178] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.178] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b65d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b65d0, pfQOP=0x0) returned 0x0 [0078.178] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.178] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.178] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b66e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b66e4, pfQOP=0x0) returned 0x0 [0078.178] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.178] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.178] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.178] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b67f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b67f8, pfQOP=0x0) returned 0x0 [0078.178] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.178] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.178] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b690c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b690c, pfQOP=0x0) returned 0x0 [0078.178] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.178] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.179] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6a20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6a20, pfQOP=0x0) returned 0x0 [0078.179] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.179] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.179] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.179] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6b34, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6b34, pfQOP=0x0) returned 0x0 [0078.179] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.179] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.179] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6c48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6c48, pfQOP=0x0) returned 0x0 [0078.179] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.179] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.179] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6d5c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6d5c, pfQOP=0x0) returned 0x0 [0078.179] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.179] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.179] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.180] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6e70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6e70, pfQOP=0x0) returned 0x0 [0078.180] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.180] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.180] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b6f84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b6f84, pfQOP=0x0) returned 0x0 [0078.180] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.180] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.180] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7098, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7098, pfQOP=0x0) returned 0x0 [0078.180] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.180] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.180] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.180] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b71ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b71ac, pfQOP=0x0) returned 0x0 [0078.180] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.180] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.180] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b72c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b72c0, pfQOP=0x0) returned 0x0 [0078.180] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.180] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.181] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b73d4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b73d4, pfQOP=0x0) returned 0x0 [0078.181] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.181] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.181] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.181] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b74e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b74e8, pfQOP=0x0) returned 0x0 [0078.181] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.181] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.181] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b75fc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b75fc, pfQOP=0x0) returned 0x0 [0078.181] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.181] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.181] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7710, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7710, pfQOP=0x0) returned 0x0 [0078.181] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.181] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.181] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.181] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7824, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7824, pfQOP=0x0) returned 0x0 [0078.182] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.182] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.182] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7938, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7938, pfQOP=0x0) returned 0x0 [0078.182] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.182] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.182] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7a4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7a4c, pfQOP=0x0) returned 0x0 [0078.182] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.182] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.182] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.182] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7b60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7b60, pfQOP=0x0) returned 0x0 [0078.182] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.182] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.182] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7c74, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7c74, pfQOP=0x0) returned 0x0 [0078.182] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.182] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.182] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7d88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7d88, pfQOP=0x0) returned 0x0 [0078.183] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.183] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.183] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.183] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7e9c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7e9c, pfQOP=0x0) returned 0x0 [0078.183] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.183] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.183] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b7fb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b7fb0, pfQOP=0x0) returned 0x0 [0078.183] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.183] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.183] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b80c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b80c4, pfQOP=0x0) returned 0x0 [0078.183] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.183] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.183] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.183] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b81d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b81d8, pfQOP=0x0) returned 0x0 [0078.184] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.184] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.184] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b82ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b82ec, pfQOP=0x0) returned 0x0 [0078.184] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.184] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.184] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8400, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8400, pfQOP=0x0) returned 0x0 [0078.184] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.184] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.184] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.184] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8514, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8514, pfQOP=0x0) returned 0x0 [0078.184] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.184] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.184] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8628, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8628, pfQOP=0x0) returned 0x0 [0078.184] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.184] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.184] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b873c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b873c, pfQOP=0x0) returned 0x0 [0078.195] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.195] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.195] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.195] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8850, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8850, pfQOP=0x0) returned 0x0 [0078.196] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.196] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.196] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8964, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8964, pfQOP=0x0) returned 0x0 [0078.196] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.196] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.196] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8a78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8a78, pfQOP=0x0) returned 0x0 [0078.196] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.196] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.196] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.196] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8b8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8b8c, pfQOP=0x0) returned 0x0 [0078.196] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.196] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.197] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8ca0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8ca0, pfQOP=0x0) returned 0x0 [0078.197] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.197] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.197] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8db4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8db4, pfQOP=0x0) returned 0x0 [0078.197] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.197] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.197] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.197] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8ec8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8ec8, pfQOP=0x0) returned 0x0 [0078.197] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.197] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.197] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b8fdc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b8fdc, pfQOP=0x0) returned 0x0 [0078.197] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.197] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.198] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b90f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b90f0, pfQOP=0x0) returned 0x0 [0078.198] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.198] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.198] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.198] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9204, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9204, pfQOP=0x0) returned 0x0 [0078.198] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.198] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.198] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9318, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9318, pfQOP=0x0) returned 0x0 [0078.198] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.198] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.200] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b942c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b942c, pfQOP=0x0) returned 0x0 [0078.201] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.201] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.201] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.201] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9540, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9540, pfQOP=0x0) returned 0x0 [0078.201] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.201] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.201] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9654, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9654, pfQOP=0x0) returned 0x0 [0078.201] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.201] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.201] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9768, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9768, pfQOP=0x0) returned 0x0 [0078.201] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.201] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.201] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.202] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b987c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b987c, pfQOP=0x0) returned 0x0 [0078.202] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.202] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.202] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9990, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9990, pfQOP=0x0) returned 0x0 [0078.202] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.202] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.202] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9aa4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9aa4, pfQOP=0x0) returned 0x0 [0078.202] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.202] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.202] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.202] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9bb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9bb8, pfQOP=0x0) returned 0x0 [0078.202] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.202] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.202] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9ccc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9ccc, pfQOP=0x0) returned 0x0 [0078.202] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.202] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.203] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9de0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9de0, pfQOP=0x0) returned 0x0 [0078.203] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.203] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.203] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.203] DecryptMessage (in: phContext=0x3349154, pMessage=0x33b9ef4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33b9ef4, pfQOP=0x0) returned 0x0 [0078.203] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.203] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.203] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba008, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba008, pfQOP=0x0) returned 0x0 [0078.203] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.203] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.203] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba11c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba11c, pfQOP=0x0) returned 0x0 [0078.203] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.203] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.204] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.204] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba230, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba230, pfQOP=0x0) returned 0x0 [0078.204] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.204] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.204] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba344, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba344, pfQOP=0x0) returned 0x0 [0078.204] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.204] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.204] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba458, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba458, pfQOP=0x0) returned 0x0 [0078.204] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.204] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.204] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.204] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba56c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba56c, pfQOP=0x0) returned 0x0 [0078.204] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.204] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.204] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba680, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba680, pfQOP=0x0) returned 0x0 [0078.204] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.205] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.205] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba794, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba794, pfQOP=0x0) returned 0x0 [0078.205] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.205] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.205] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.205] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba8a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba8a8, pfQOP=0x0) returned 0x0 [0078.205] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.205] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.205] DecryptMessage (in: phContext=0x3349154, pMessage=0x33ba9bc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33ba9bc, pfQOP=0x0) returned 0x0 [0078.205] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.205] recv (in: s=0x6b0, buf=0x3327eb5, len=1392, flags=0 | out: buf=0x3327eb5*) returned 1392 [0078.205] DecryptMessage (in: phContext=0x3349154, pMessage=0x33baad0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33baad0, pfQOP=0x0) returned 0x0 [0078.205] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.206] recv (in: s=0x6b0, buf=0x3327eb0, len=5, flags=0 | out: buf=0x3327eb0*) returned 5 [0078.206] DecryptMessage (in: phContext=0x3349154, pMessage=0x33babe4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33babe4, pfQOP=0x0) returned 0x0 [0078.206] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bacf8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bacf8, pfQOP=0x0) returned 0x0 [0078.206] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bae0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bae0c, pfQOP=0x0) returned 0x0 [0078.206] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.206] DecryptMessage (in: phContext=0x3349154, pMessage=0x33baf20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33baf20, pfQOP=0x0) returned 0x0 [0078.206] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb034, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb034, pfQOP=0x0) returned 0x0 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb148, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb148, pfQOP=0x0) returned 0x0 [0078.207] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb25c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb25c, pfQOP=0x0) returned 0x0 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb370, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb370, pfQOP=0x0) returned 0x0 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb484, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb484, pfQOP=0x0) returned 0x0 [0078.207] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb598, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb598, pfQOP=0x0) returned 0x0 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb6ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb6ac, pfQOP=0x0) returned 0x0 [0078.207] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb7c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb7c0, pfQOP=0x0) returned 0x0 [0078.207] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb8d4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb8d4, pfQOP=0x0) returned 0x0 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bb9e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bb9e8, pfQOP=0x0) returned 0x0 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bbafc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bbafc, pfQOP=0x0) returned 0x0 [0078.208] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bbc10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bbc10, pfQOP=0x0) returned 0x0 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bbd24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bbd24, pfQOP=0x0) returned 0x0 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bbe38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bbe38, pfQOP=0x0) returned 0x0 [0078.208] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bbf4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bbf4c, pfQOP=0x0) returned 0x0 [0078.208] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc060, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc060, pfQOP=0x0) returned 0x0 [0078.209] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc174, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc174, pfQOP=0x0) returned 0x0 [0078.209] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.209] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc288, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc288, pfQOP=0x0) returned 0x0 [0078.211] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc39c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc39c, pfQOP=0x0) returned 0x0 [0078.211] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc4b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc4b0, pfQOP=0x0) returned 0x0 [0078.211] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.211] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc5c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc5c4, pfQOP=0x0) returned 0x0 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc6d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc6d8, pfQOP=0x0) returned 0x0 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc7ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc7ec, pfQOP=0x0) returned 0x0 [0078.212] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bc900, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bc900, pfQOP=0x0) returned 0x0 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bca14, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bca14, pfQOP=0x0) returned 0x0 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bcb28, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bcb28, pfQOP=0x0) returned 0x0 [0078.212] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bcc3c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bcc3c, pfQOP=0x0) returned 0x0 [0078.212] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bcd50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bcd50, pfQOP=0x0) returned 0x0 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bce64, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bce64, pfQOP=0x0) returned 0x0 [0078.213] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bcf78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bcf78, pfQOP=0x0) returned 0x0 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd08c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd08c, pfQOP=0x0) returned 0x0 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd1a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd1a0, pfQOP=0x0) returned 0x0 [0078.213] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd2b4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd2b4, pfQOP=0x0) returned 0x0 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd3c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd3c8, pfQOP=0x0) returned 0x0 [0078.213] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd4dc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd4dc, pfQOP=0x0) returned 0x0 [0078.214] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd5f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd5f0, pfQOP=0x0) returned 0x0 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd704, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd704, pfQOP=0x0) returned 0x0 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd818, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd818, pfQOP=0x0) returned 0x0 [0078.214] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bd92c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bd92c, pfQOP=0x0) returned 0x0 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bda40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bda40, pfQOP=0x0) returned 0x0 [0078.214] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bdb54, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bdb54, pfQOP=0x0) returned 0x0 [0078.214] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bdc68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bdc68, pfQOP=0x0) returned 0x0 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bdd7c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bdd7c, pfQOP=0x0) returned 0x0 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bde90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bde90, pfQOP=0x0) returned 0x0 [0078.215] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bdfa4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bdfa4, pfQOP=0x0) returned 0x0 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be0b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be0b8, pfQOP=0x0) returned 0x0 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be1cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be1cc, pfQOP=0x0) returned 0x0 [0078.215] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be2e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be2e0, pfQOP=0x0) returned 0x0 [0078.215] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be3f4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be3f4, pfQOP=0x0) returned 0x0 [0078.216] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be508, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be508, pfQOP=0x0) returned 0x0 [0078.216] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.216] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be61c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be61c, pfQOP=0x0) returned 0x0 [0078.216] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be730, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be730, pfQOP=0x0) returned 0x0 [0078.216] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be844, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be844, pfQOP=0x0) returned 0x0 [0078.216] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33be958, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33be958, pfQOP=0x0) returned 0x0 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bea6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bea6c, pfQOP=0x0) returned 0x0 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33beb80, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33beb80, pfQOP=0x0) returned 0x0 [0078.217] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bec94, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bec94, pfQOP=0x0) returned 0x0 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33beda8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33beda8, pfQOP=0x0) returned 0x0 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33beebc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33beebc, pfQOP=0x0) returned 0x0 [0078.217] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33befd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33befd0, pfQOP=0x0) returned 0x0 [0078.217] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf0e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf0e4, pfQOP=0x0) returned 0x0 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf1f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf1f8, pfQOP=0x0) returned 0x0 [0078.218] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf30c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf30c, pfQOP=0x0) returned 0x0 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf420, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf420, pfQOP=0x0) returned 0x0 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf534, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf534, pfQOP=0x0) returned 0x0 [0078.218] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf648, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf648, pfQOP=0x0) returned 0x0 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf75c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf75c, pfQOP=0x0) returned 0x0 [0078.218] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf870, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf870, pfQOP=0x0) returned 0x0 [0078.218] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bf984, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bf984, pfQOP=0x0) returned 0x0 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfa98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfa98, pfQOP=0x0) returned 0x0 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfbac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfbac, pfQOP=0x0) returned 0x0 [0078.219] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfcc0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfcc0, pfQOP=0x0) returned 0x0 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfdd4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfdd4, pfQOP=0x0) returned 0x0 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfee8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfee8, pfQOP=0x0) returned 0x0 [0078.219] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.219] DecryptMessage (in: phContext=0x3349154, pMessage=0x33bfffc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33bfffc, pfQOP=0x0) returned 0x0 [0078.220] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0110, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0110, pfQOP=0x0) returned 0x0 [0078.220] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0224, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0224, pfQOP=0x0) returned 0x0 [0078.220] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.220] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0338, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0338, pfQOP=0x0) returned 0x0 [0078.220] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c044c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c044c, pfQOP=0x0) returned 0x0 [0078.220] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0560, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0560, pfQOP=0x0) returned 0x0 [0078.220] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0674, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0674, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0788, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0788, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c089c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c089c, pfQOP=0x0) returned 0x0 [0078.221] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c09b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c09b0, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0ac4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0ac4, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0bd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0bd8, pfQOP=0x0) returned 0x0 [0078.221] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0cec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0cec, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0e00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0e00, pfQOP=0x0) returned 0x0 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c0f14, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c0f14, pfQOP=0x0) returned 0x0 [0078.221] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.221] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1028, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1028, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c113c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c113c, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1250, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1250, pfQOP=0x0) returned 0x0 [0078.222] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1364, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1364, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1478, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1478, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c158c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c158c, pfQOP=0x0) returned 0x0 [0078.222] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c16a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c16a0, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c17b4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c17b4, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c18c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c18c8, pfQOP=0x0) returned 0x0 [0078.222] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c19dc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c19dc, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1af0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1af0, pfQOP=0x0) returned 0x0 [0078.222] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1c04, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1c04, pfQOP=0x0) returned 0x0 [0078.222] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1d18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1d18, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1e2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1e2c, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c1f40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c1f40, pfQOP=0x0) returned 0x0 [0078.223] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2054, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2054, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2168, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2168, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c227c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c227c, pfQOP=0x0) returned 0x0 [0078.223] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2390, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2390, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c24a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c24a4, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c25b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c25b8, pfQOP=0x0) returned 0x0 [0078.223] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c26cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c26cc, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c27e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c27e0, pfQOP=0x0) returned 0x0 [0078.223] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c28f4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c28f4, pfQOP=0x0) returned 0x0 [0078.224] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2a08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2a08, pfQOP=0x0) returned 0x0 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2b1c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2b1c, pfQOP=0x0) returned 0x0 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2c30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2c30, pfQOP=0x0) returned 0x0 [0078.224] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2d44, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2d44, pfQOP=0x0) returned 0x0 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2e58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2e58, pfQOP=0x0) returned 0x0 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c2f6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c2f6c, pfQOP=0x0) returned 0x0 [0078.224] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c3080, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c3080, pfQOP=0x0) returned 0x0 [0078.224] DecryptMessage (in: phContext=0x3349154, pMessage=0x33c3194, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x33c3194, pfQOP=0x0) returned 0x0 [0078.225] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.226] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x138e904, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e904*=0x1000, lpOverlapped=0x0) returned 1 [0078.226] WriteFile (in: hFile=0x6a4, lpBuffer=0x33b17c8*, nNumberOfBytesToWrite=0xa5e, lpNumberOfBytesWritten=0x138e8e4, lpOverlapped=0x0 | out: lpBuffer=0x33b17c8*, lpNumberOfBytesWritten=0x138e8e4*=0xa5e, lpOverlapped=0x0) returned 1 [0078.226] CloseHandle (hObject=0x6a4) returned 1 [0078.323] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg"), fWinIni=0x3 | out: pvParam=0x32f0a78) returned 1 [0078.430] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x1a, wParam=0x14, lParam=0x128d008) returned 0x0 [0078.430] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x1a, wParam=0x14, lParam=0x128d008) returned 0x0 [0078.431] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0x138e530, fWinIni=0x0 | out: pvParam=0x138e530) returned 1 [0078.433] PostMessageW (hWnd=0x70030, Msg=0x201a, wParam=0x14, lParam=0x16cac98) returned 1 [0078.433] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x1a, wParam=0x14, lParam=0x128d008) returned 0x0 [0079.213] QueryPerformanceCounter (in: lpPerformanceCount=0x138e908 | out: lpPerformanceCount=0x138e908*=17499364439) returned 1 [0079.214] SetEvent (hEvent=0x2e8) returned 1 [0079.214] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e710*=0x494, lpdwindex=0x138e52c | out: lpdwindex=0x138e52c) returned 0x80010115 [0079.214] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e6f0*=0x484, lpdwindex=0x138e50c | out: lpdwindex=0x138e50c) returned 0x80010115 [0079.215] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e6f0*=0x48c, lpdwindex=0x138e50c | out: lpdwindex=0x138e50c) returned 0x80010115 [0079.215] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e744*=0x4b4, lpdwindex=0x138e564 | out: lpdwindex=0x138e564) returned 0x80010115 [0079.215] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e744*=0x4bc, lpdwindex=0x138e564 | out: lpdwindex=0x138e564) returned 0x80010115 [0079.216] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e744*=0x4c4, lpdwindex=0x138e564 | out: lpdwindex=0x138e564) returned 0x80010115 [0079.216] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6a4 [0079.216] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6b4 [0079.216] GetAddrInfoW (in: pNodeName="google.com", pServiceName=0x0, pHints=0x138e644*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x138e5ec | out: ppResult=0x138e5ec*=0x16e0f20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="google.com", ai_addr=0x16e2740*(sa_family=2, sin_port=0x0, sin_addr="172.217.23.142"), ai_next=0x0)) returned 0 [0079.220] FreeAddrInfoW (pAddrInfo=0x16e0f20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="google.com", ai_addr=0x16e2740*(sa_family=2, sin_port=0x0, sin_addr="172.217.23.142"), ai_next=0x0)) [0079.220] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e588*=0x5b4, lpdwindex=0x138e3a4 | out: lpdwindex=0x138e3a4) returned 0x80010115 [0079.220] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x138e588*=0x5bc, lpdwindex=0x138e3a4 | out: lpdwindex=0x138e3a4) returned 0x80010115 [0079.220] WSAConnect (in: s=0x6a4, name=0x33c5860*(sa_family=2, sin_port=0x50, sin_addr="172.217.23.142"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0079.240] closesocket (s=0x6b4) returned 0 [0079.240] send (s=0x6a4, buf=0x330d6c8*, len=165, flags=0) returned 165 [0079.241] setsockopt (s=0x6a4, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0079.241] recv (in: s=0x6a4, buf=0x3346660, len=4096, flags=0 | out: buf=0x3346660*) returned 1724 [0079.280] setsockopt (s=0x6a4, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0079.303] GetWindowThreadProcessId (in: hWnd=0x6002e, lpdwProcessId=0x138ea10 | out: lpdwProcessId=0x138ea10) returned 0x13dc [0079.303] GetCurrentThreadId () returned 0x13dc [0079.303] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a0 [0079.304] PostMessageW (hWnd=0x6002e, Msg=0xc1a0, wParam=0x0, lParam=0x0) returned 1 [0079.304] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0079.304] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0079.304] GetSystemMetrics (nIndex=42) returned 0 [0079.304] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e984, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0079.304] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e984) returned 0xb [0079.307] OleInitialize (pvReserved=0x0) returned 0x0 [0079.308] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x138ef3c | out: lplpMessageFilter=0x138ef3c*=0x0) returned 0x0 [0079.308] PeekMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.308] IsWindowUnicode (hWnd=0x6002e) returned 1 [0079.309] GetMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.309] TranslateMessage (lpMsg=0x138ef10) returned 0 [0079.309] DispatchMessageW (lpMsg=0x138ef10) returned 0x0 [0079.310] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x138ec64) returned 0x0 [0079.310] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x1, lParam=0x138ec3c) returned 0x0 [0079.311] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x85, wParam=0x180407b8, lParam=0x0) returned 0x0 [0079.312] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e9ac | out: lpwndpl=0x138e9ac) returned 1 [0079.312] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e958 | out: lpRect=0x138e958) returned 1 [0079.312] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0079.312] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0079.312] GetSystemMetrics (nIndex=42) returned 0 [0079.312] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e818, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0079.312] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e818) returned 0xb [0079.312] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e860 | out: lpRect=0x138e860) returned 1 [0079.312] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0079.312] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0079.312] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0xffffffffaa050796 [0079.312] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0079.312] SaveDC (hdc=0xf0105ee) returned 1 [0079.312] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0079.312] CreateSolidBrush (color=0xf0f0f0) returned 0x59100798 [0079.312] FillRect (hDC=0xf0105ee, lprc=0x138e700, hbr=0x59100798) returned 1 [0079.312] DeleteObject (ho=0x59100798) returned 1 [0079.312] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0079.313] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e990 | out: lpwndpl=0x138e990) returned 1 [0079.313] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x138ec64) returned 0x0 [0079.313] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e940 | out: lpRect=0x138e940) returned 1 [0079.313] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138e940 | out: lpRect=0x138e940) returned 1 [0079.314] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x1, lParam=0x138e77c) returned 0x0 [0079.314] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x85, wParam=0x1b0407b8, lParam=0x0) returned 0x0 [0079.315] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e4ec | out: lpwndpl=0x138e4ec) returned 1 [0079.315] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e498 | out: lpRect=0x138e498) returned 1 [0079.315] GetWindowTextLengthW (hWnd=0x6002e) returned 11 [0079.315] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0079.315] GetSystemMetrics (nIndex=42) returned 0 [0079.315] GetWindowTextW (in: hWnd=0x6002e, lpString=0x138e358, nMaxCount=12 | out: lpString="hidden tear") returned 11 [0079.315] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0xd, wParam=0xc, lParam=0x138e358) returned 0xb [0079.315] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e3a0 | out: lpRect=0x138e3a0) returned 1 [0079.315] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0079.315] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0079.315] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0xffffffffaa050796 [0079.315] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0079.315] SaveDC (hdc=0x10105d6) returned 1 [0079.315] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0079.315] CreateSolidBrush (color=0xf0f0f0) returned 0x5a100798 [0079.315] FillRect (hDC=0x10105d6, lprc=0x138e240, hbr=0x5a100798) returned 1 [0079.315] DeleteObject (ho=0x5a100798) returned 1 [0079.316] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0079.316] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0079.316] PeekMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.316] IsWindowUnicode (hWnd=0x7005c) returned 1 [0079.316] GetMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.316] TranslateMessage (lpMsg=0x138ef10) returned 0 [0079.316] DispatchMessageW (lpMsg=0x138ef10) returned 0x0 [0079.316] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0079.316] PeekMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.316] IsWindowUnicode (hWnd=0x70030) returned 1 [0079.316] GetMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.316] TranslateMessage (lpMsg=0x138ef10) returned 0 [0079.316] DispatchMessageW (lpMsg=0x138ef10) returned 0x0 [0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e5c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0079.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e538, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0079.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0079.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x138ea44) returned 1 [0079.327] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\hidden-tear.exe"), fInfoLevelId=0x0, lpFileInformation=0x138eac0 | out: lpFileInformation=0x138eac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0079.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x138ea40) returned 1 [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e598, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0079.330] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", nBufferLength=0x105, lpBuffer=0x138e52c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\hidden-tear.exe", lpFilePart=0x0) returned 0x27 [0079.339] GetWindowThreadProcessId (in: hWnd=0x502ba, lpdwProcessId=0x138eb3c | out: lpdwProcessId=0x138eb3c) returned 0x13dc [0079.339] GetCurrentThreadId () returned 0x13dc [0079.363] GetWindowThreadProcessId (in: hWnd=0x502ba, lpdwProcessId=0x138eb3c | out: lpdwProcessId=0x138eb3c) returned 0x13dc [0079.363] GetCurrentThreadId () returned 0x13dc [0079.364] LocalFree (hMem=0x16cac98) returned 0x0 [0079.364] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x201a, wParam=0x14, lParam=0x16cac98) returned 0x0 [0079.364] PeekMessageW (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x138ef10) returned 1 [0079.365] GetMessageA (in: lpMsg=0x138ef10, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x138ef10) returned 0 [0079.369] DestroyCursor (hCursor=0x1c0129) returned 1 [0079.371] GetWindowLongW (hWnd=0x6002e, nIndex=-20) returned 590208 [0079.371] DestroyWindow (hWnd=0x6002e) returned 1 [0079.371] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0079.371] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x138ecc4) returned 0x0 [0079.373] GetWindowPlacement (in: hWnd=0x6002e, lpwndpl=0x138e9f0 | out: lpwndpl=0x138e9f0) returned 1 [0079.373] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x138ecc4) returned 0x0 [0079.373] GetClientRect (in: hWnd=0x6002e, lpRect=0x138e9a0 | out: lpRect=0x138e9a0) returned 1 [0079.373] GetWindowRect (in: hWnd=0x6002e, lpRect=0x138e9a0 | out: lpRect=0x138e9a0) returned 1 [0079.373] PostThreadMessageW (idThread=0x13dc, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0079.374] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0079.374] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0079.374] DestroyWindow (hWnd=0x7005c) returned 1 [0079.374] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0079.374] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0079.375] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0079.381] GetCurrentThreadId () returned 0x13dc [0079.382] EnumThreadWindows (dwThreadId=0x13dc, lpfn=0x32204de, lParam=0x0) returned 1 [0079.382] IsWindowVisible (hWnd=0x70030) returned 0 [0079.382] IsWindowVisible (hWnd=0x901f8) returned 0 [0079.382] GetCurrentThreadId () returned 0x13dc [0079.382] GetCurrentThreadId () returned 0x13dc [0079.383] EnumThreadWindows (dwThreadId=0x13dc, lpfn=0x3220506, lParam=0x0) returned 1 [0079.383] IsWindowVisible (hWnd=0x70030) returned 0 [0079.383] IsWindowVisible (hWnd=0x901f8) returned 0 [0079.387] OleUninitialize () [0079.387] CloseHandle (hObject=0x2f0) returned 1 [0079.387] DeactivateActCtx (dwFlags=0x0, ulCookie=0x13de0002) returned 1 [0079.388] CoGetContextToken (in: pToken=0x138f8b8 | out: pToken=0x138f8b8) returned 0x0 [0079.388] CObjectContext::QueryInterface () returned 0x0 [0079.388] CObjectContext::GetCurrentThreadType () returned 0x0 [0079.388] Release () returned 0x0 [0079.388] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x16600d0*=0x198, lpdwindex=0x138f75c | out: lpdwindex=0x138f75c) returned 0x0 Thread: id = 2 os_tid = 0x13f8 Thread: id = 3 os_tid = 0x1038 Thread: id = 4 os_tid = 0x1164 [0042.582] CoGetContextToken (in: pToken=0x534fc04 | out: pToken=0x534fc04) returned 0x800401f0 [0042.582] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0042.582] RoInitialize () returned 0x1 [0042.582] RoUninitialize () returned 0x0 [0053.655] CloseHandle (hObject=0x2e0) returned 1 [0053.655] CloseHandle (hObject=0x2cc) returned 1 [0053.655] CloseHandle (hObject=0x2dc) returned 1 [0053.656] CloseHandle (hObject=0x2d8) returned 1 [0053.656] CloseHandle (hObject=0x2e8) returned 1 [0053.656] CloseHandle (hObject=0x2d4) returned 1 [0053.656] CloseHandle (hObject=0x2d0) returned 1 [0053.656] CloseHandle (hObject=0x2e4) returned 1 [0079.553] SetWindowLongW (hWnd=0x502ba, nIndex=-4, dwNewLong=1950089536) returned 52561382 [0079.553] SetClassLongW (hWnd=0x502ba, nIndex=-24, dwNewLong=1950089536) returned 0x32205be [0079.554] PostMessageW (hWnd=0x502ba, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0079.554] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0079.554] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", hInstance=0xfc0000) returned 1 [0079.555] GetModuleHandleW (lpModuleName=0x0) returned 0xfc0000 [0079.555] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", hInstance=0xfc0000) returned 0 [0079.555] EtwEventUnregister (RegHandle=0x1660ff0) returned 0x0 [0079.555] EtwEventUnregister (RegHandle=0x16c30a8) returned 0x0 [0079.557] IsWindow (hWnd=0x70030) returned 1 [0079.557] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0079.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x534f9a4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWâq\x82\x94\x87_ðù°s(ü4\x05\x01", lpUsedDefaultChar=0x0) returned 14 [0079.558] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0079.558] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=1950089536) returned 52561542 [0079.558] SetClassLongW (hWnd=0x70030, nIndex=-24, dwNewLong=1950089536) returned 0x3220686 [0079.558] IsWindow (hWnd=0x70030) returned 1 [0079.558] DestroyWindow (hWnd=0x70030) returned 0 [0079.558] PostMessageW (hWnd=0x70030, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0079.559] SetConsoleCtrlHandler (HandlerRoutine=0x322065e, Add=0) returned 1 [0079.559] DeleteObject (ho=0x2008078b) returned 1 [0079.572] GdipDeleteFont (font=0x5a6ef48) returned 0x0 [0079.573] DeleteObject (ho=0x7f0a0512) returned 1 [0079.573] DestroyCursor (hCursor=0x660297) returned 1 [0079.574] CertFreeCertificateContext (pCertContext=0x16e17d0) returned 1 [0079.575] CertFreeCertificateContext (pCertContext=0x16e1d70) returned 1 [0079.575] CertFreeCertificateContext (pCertContext=0x16e1820) returned 1 [0079.575] CertFreeCertificateContext (pCertContext=0x16e18c0) returned 1 [0079.576] CertCloseStore (hCertStore=0x16d91d8, dwFlags=0x0) returned 1 [0079.576] CertFreeCertificateContext (pCertContext=0x16e18c0) returned 1 [0079.577] CertFreeCertificateContext (pCertContext=0x16e15f0) returned 1 [0079.577] DeleteSecurityContext (phContext=0x33162b0) returned 0x0 [0079.578] CloseHandle (hObject=0x5c8) returned 1 [0079.579] CertCloseStore (hCertStore=0x16eaf70, dwFlags=0x0) returned 1 [0079.579] setsockopt (s=0x5b8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0079.579] closesocket (s=0x5b8) returned 0 [0079.579] CloseHandle (hObject=0x5bc) returned 1 [0079.580] setsockopt (s=0x5ac, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0079.580] closesocket (s=0x5ac) returned 0 [0079.580] CloseHandle (hObject=0x5b4) returned 1 [0079.580] setsockopt (s=0x5a4, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0079.580] closesocket (s=0x5a4) returned 0 [0079.582] CertFreeCertificateContext (pCertContext=0x16e17d0) returned 1 [0079.582] CloseHandle (hObject=0x55c) returned 1 [0079.583] CloseHandle (hObject=0x558) returned 1 [0079.583] CertFreeCertificateContext (pCertContext=0x16e1910) returned 1 [0079.583] CloseHandle (hObject=0x514) returned 1 [0079.583] CloseHandle (hObject=0x510) returned 1 [0079.584] WinHttpCloseHandle (hInternet=0x83f21c8) returned 1 [0079.584] CloseHandle (hObject=0x4c8) returned 1 [0079.584] CloseHandle (hObject=0x4c4) returned 1 [0079.585] RegCloseKey (hKey=0x4c0) returned 0x0 [0079.585] CloseHandle (hObject=0x4bc) returned 1 [0079.585] RegCloseKey (hKey=0x4b8) returned 0x0 [0079.585] CloseHandle (hObject=0x4b4) returned 1 [0079.586] RegCloseKey (hKey=0x4b0) returned 0x0 [0079.586] RegCloseKey (hKey=0x4ac) returned 0x0 [0079.586] CloseHandle (hObject=0x494) returned 1 [0079.586] setsockopt (s=0x488, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0079.586] closesocket (s=0x488) returned 0 [0079.587] CloseHandle (hObject=0x48c) returned 1 [0079.587] setsockopt (s=0x480, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0079.587] closesocket (s=0x480) returned 0 [0079.587] CloseHandle (hObject=0x484) returned 1 [0079.588] CloseHandle (hObject=0x418) returned 1 [0079.588] CloseHandle (hObject=0x414) returned 1 [0079.588] CloseHandle (hObject=0x410) returned 1 [0079.588] CloseHandle (hObject=0x3fc) returned 1 [0079.588] CloseHandle (hObject=0x2e0) returned 1 [0079.588] CloseHandle (hObject=0x2cc) returned 1 [0079.589] CloseHandle (hObject=0x2dc) returned 1 [0079.589] CloseHandle (hObject=0x2d4) returned 1 [0079.589] CloseHandle (hObject=0x2d0) returned 1 [0079.590] FreeCredentialsHandle (phCredential=0x33160ac) returned 0x0 [0079.590] DeleteSecurityContext (phContext=0x3349154) returned 0x0 [0079.591] CloseHandle (hObject=0x2e4) returned 1 [0079.591] UnmapViewOfFile (lpBaseAddress=0x59c0000) returned 1 [0079.596] setsockopt (s=0x6a4, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0079.596] closesocket (s=0x6a4) returned 0 [0079.597] setsockopt (s=0x6b0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0079.597] closesocket (s=0x6b0) returned 0 [0079.598] CertFreeCertificateContext (pCertContext=0x16e1960) returned 1 [0079.599] CertFreeCertificateContext (pCertContext=0x16e1500) returned 1 [0079.599] RegCloseKey (hKey=0x80000004) returned 0x0 [0079.601] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0x1024 Thread: id = 6 os_tid = 0xf64 Thread: id = 7 os_tid = 0xf04 Thread: id = 8 os_tid = 0xf2c [0067.157] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0067.157] RoInitialize () returned 0x1 [0067.157] RoUninitialize () returned 0x0 [0067.159] ResetEvent (hEvent=0x2e8) returned 1 Thread: id = 9 os_tid = 0x2bc Thread: id = 10 os_tid = 0x648 Thread: id = 11 os_tid = 0xed0 Thread: id = 12 os_tid = 0xf68 Thread: id = 13 os_tid = 0xa24