# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 21.12.2020 07:04:45.575 Process: id = "1" image_name = "gukwrkmtoehnh8cz.exe" filename = "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe" page_root = "0x14438000" os_pid = "0x1130" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x112c [0066.162] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0067.304] RoInitialize () returned 0x1 [0067.304] RoUninitialize () returned 0x0 [0069.568] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x55e5d0 | out: phkResult=0x55e5d0*=0x0) returned 0x2 [0069.569] RegCloseKey (hKey=0x80000002) returned 0x0 [0069.612] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x104, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0069.631] IsAppThemed () returned 0x1 [0069.672] CoTaskMemAlloc (cb=0xf0) returned 0x769928 [0069.673] CreateActCtxA (pActCtx=0x55ed78) returned 0x769b1c [0069.781] CoTaskMemFree (pv=0x769928) [0069.794] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0069.794] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc197 [0071.561] CoTaskMemAlloc (cb=0x20c) returned 0x77c450 [0071.561] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x77c450 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 0x0 [0071.659] CoTaskMemFree (pv=0x77c450) [0071.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0071.659] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0071.659] CoTaskMemAlloc (cb=0x20c) returned 0x77c450 [0071.659] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x77c450 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0071.660] CoTaskMemFree (pv=0x77c450) [0071.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0071.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0071.661] CoTaskMemAlloc (cb=0x20c) returned 0x77c450 [0071.661] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x77c450 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 0x0 [0071.661] CoTaskMemFree (pv=0x77c450) [0071.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0071.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0072.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", nBufferLength=0x105, lpBuffer=0x55df30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", lpFilePart=0x0) returned 0x33 [0073.501] GetCurrentProcess () returned 0xffffffff [0073.501] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e298 | out: TokenHandle=0x55e298*=0x360) returned 1 [0073.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0073.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0073.509] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x55e290 | out: lpFileInformation=0x55e290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.511] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0073.511] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0073.511] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x55e298 | out: lpFileInformation=0x55e298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0073.512] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0073.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e1d0) returned 1 [0073.514] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0073.514] GetFileType (hFile=0x35c) returned 0x1 [0073.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e1cc) returned 1 [0073.514] GetFileType (hFile=0x35c) returned 0x1 [0073.811] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x55e21c | out: phkResult=0x55e21c*=0x0) returned 0x2 [0073.811] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x55e21c | out: phkResult=0x55e21c*=0x0) returned 0x2 [0073.813] GetFileSize (in: hFile=0x35c, lpFileSizeHigh=0x55e28c | out: lpFileSizeHigh=0x55e28c*=0x0) returned 0x8c8f [0073.813] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55e248, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55e248*=0x1000, lpOverlapped=0x0) returned 1 [0073.895] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55e0f4, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55e0f4*=0x1000, lpOverlapped=0x0) returned 1 [0073.897] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55dfa8, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55dfa8*=0x1000, lpOverlapped=0x0) returned 1 [0073.898] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55dfa8, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55dfa8*=0x1000, lpOverlapped=0x0) returned 1 [0073.898] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55dfa8, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55dfa8*=0x1000, lpOverlapped=0x0) returned 1 [0073.898] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55dee0, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55dee0*=0x1000, lpOverlapped=0x0) returned 1 [0073.948] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55e064, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55e064*=0x1000, lpOverlapped=0x0) returned 1 [0073.950] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55df70, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55df70*=0x1000, lpOverlapped=0x0) returned 1 [0073.950] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55df70, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55df70*=0xc8f, lpOverlapped=0x0) returned 1 [0073.950] ReadFile (in: hFile=0x35c, lpBuffer=0x235aaac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x55e034, lpOverlapped=0x0 | out: lpBuffer=0x235aaac*, lpNumberOfBytesRead=0x55e034*=0x0, lpOverlapped=0x0) returned 1 [0073.951] CloseHandle (hObject=0x35c) returned 1 [0073.953] GetCurrentProcess () returned 0xffffffff [0073.953] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e3e0 | out: TokenHandle=0x55e3e0*=0x35c) returned 1 [0073.953] GetCurrentProcess () returned 0xffffffff [0073.953] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e3e0 | out: TokenHandle=0x55e3e0*=0x354) returned 1 [0073.954] GetCurrentProcess () returned 0xffffffff [0073.954] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e298 | out: TokenHandle=0x55e298*=0x364) returned 1 [0073.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x55e290 | out: lpFileInformation=0x55e290*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", lpFilePart=0x0) returned 0x33 [0073.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x55e298 | out: lpFileInformation=0x55e298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.955] GetCurrentProcess () returned 0xffffffff [0073.955] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e3e0 | out: TokenHandle=0x55e3e0*=0x368) returned 1 [0073.955] GetCurrentProcess () returned 0xffffffff [0073.955] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e3e0 | out: TokenHandle=0x55e3e0*=0x36c) returned 1 [0074.471] GetCurrentProcess () returned 0xffffffff [0074.471] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e240 | out: TokenHandle=0x55e240*=0x370) returned 1 [0074.487] GetCurrentProcess () returned 0xffffffff [0074.487] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e250 | out: TokenHandle=0x55e250*=0x374) returned 1 [0074.493] GetCurrentProcess () returned 0xffffffff [0074.493] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e984 | out: TokenHandle=0x55e984*=0x378) returned 1 [0074.494] GetCurrentProcess () returned 0xffffffff [0074.494] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x55e994 | out: TokenHandle=0x55e994*=0x37c) returned 1 [0074.541] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0074.544] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0075.506] AdjustWindowRectEx (in: lpRect=0x55edb4, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x55edb4) returned 1 [0075.510] GetCurrentProcess () returned 0xffffffff [0075.510] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x55ecc8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x55ecc8*=0x384) returned 1 [0075.567] GetCurrentActCtx (in: lphActCtx=0x55ec28 | out: lphActCtx=0x55ec28*=0x0) returned 1 [0075.567] ActivateActCtx (in: hActCtx=0x769b1c, lpCookie=0x55ec38 | out: hActCtx=0x769b1c, lpCookie=0x55ec38) returned 1 [0075.568] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0075.570] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0077.097] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0077.097] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0077.098] GetStockObject (i=5) returned 0x900015 [0077.101] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0077.103] CoTaskMemAlloc (cb=0x5a) returned 0x771f40 [0077.103] RegisterClassW (lpWndClass=0x55eadc) returned 0xc196 [0077.104] CoTaskMemFree (pv=0x771f40) [0077.104] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0077.104] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x8005c [0077.106] SetWindowLongW (hWnd=0x8005c, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0077.107] GetWindowLongW (hWnd=0x8005c, nIndex=-4) returned 1950089536 [0077.108] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x55e2f8 | out: phkResult=0x55e2f8*=0x39c) returned 0x0 [0077.108] RegQueryValueExW (in: hKey=0x39c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x55e318, lpData=0x0, lpcbData=0x55e314*=0x0 | out: lpType=0x55e318*=0x0, lpData=0x0, lpcbData=0x55e314*=0x0) returned 0x2 [0077.108] RegQueryValueExW (in: hKey=0x39c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x55e318, lpData=0x0, lpcbData=0x55e314*=0x0 | out: lpType=0x55e318*=0x0, lpData=0x0, lpcbData=0x55e314*=0x0) returned 0x2 [0077.109] RegCloseKey (hKey=0x39c) returned 0x0 [0077.110] SetWindowLongW (hWnd=0x8005c, nIndex=-4, dwNewLong=77465102) returned 1950089536 [0077.110] GetWindowLongW (hWnd=0x8005c, nIndex=-4) returned 77465102 [0077.110] GetWindowLongW (hWnd=0x8005c, nIndex=-16) returned 113311744 [0077.111] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19a [0077.112] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19b [0077.112] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x81, wParam=0x0, lParam=0x55e648) returned 0x1 [0077.113] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x0, lParam=0x55e634) returned 0x0 [0078.075] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x1, wParam=0x0, lParam=0x55e648) returned 0x0 [0078.076] GetClientRect (in: hWnd=0x8005c, lpRect=0x55e330 | out: lpRect=0x55e330) returned 1 [0078.076] GetWindowRect (in: hWnd=0x8005c, lpRect=0x55e330 | out: lpRect=0x55e330) returned 1 [0078.077] GetParent (hWnd=0x8005c) returned 0x0 [0078.077] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1b450001) returned 1 [0078.577] EtwEventRegister (in: ProviderId=0x2377994, EnableCallback=0x49e0636, CallbackContext=0x0, RegHandle=0x2377970 | out: RegHandle=0x2377970) returned 0x0 [0078.582] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0078.583] AdjustWindowRectEx (in: lpRect=0x55ebf0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf0) returned 1 [0078.583] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0078.583] AdjustWindowRectEx (in: lpRect=0x55ebf0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf0) returned 1 [0078.584] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0078.584] AdjustWindowRectEx (in: lpRect=0x55ebf0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf0) returned 1 [0078.591] GetSystemDefaultLCID () returned 0x409 [0078.591] GetStockObject (i=17) returned 0xa01c1 [0078.592] GetObjectW (in: h=0xa01c1, c=92, pv=0x55e9ac | out: pv=0x55e9ac) returned 92 [0078.593] GetDC (hWnd=0x0) returned 0x60100ce [0078.711] GdiplusStartup (in: token=0xaa5ee8, input=0x55df60, output=0x55dfb0 | out: token=0xaa5ee8, output=0x55dfb0) returned 0x0 [0078.719] CoTaskMemAlloc (cb=0x5c) returned 0x772218 [0078.720] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x772218, font=0x55ea74) returned 0x0 [0080.213] CoTaskMemFree (pv=0x772218) [0080.214] CoTaskMemAlloc (cb=0x5c) returned 0x772558 [0080.214] CoTaskMemFree (pv=0x772558) [0080.214] CoTaskMemAlloc (cb=0x5c) returned 0x771e70 [0080.215] CoTaskMemFree (pv=0x771e70) [0080.215] GdipGetFontUnit (font=0x4af1f08, unit=0x55ea3c) returned 0x0 [0080.215] GdipGetFontSize (font=0x4af1f08, size=0x55ea40) returned 0x0 [0080.215] GdipGetFontStyle (font=0x4af1f08, style=0x55ea38) returned 0x0 [0080.216] GdipGetFamily (font=0x4af1f08, family=0x55ea34) returned 0x0 [0080.216] GdipGetFontSize (font=0x4af1f08, size=0x237875c) returned 0x0 [0080.216] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0080.216] GetDC (hWnd=0x0) returned 0xf0105ee [0080.217] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55ea50) returned 0x0 [0080.226] GdipGetDpiY (graphics=0x5c0f260, dpi=0x2378838) returned 0x0 [0080.226] GdipGetFontHeight (font=0x4af1f08, graphics=0x5c0f260, height=0x55ea48) returned 0x0 [0080.226] GdipGetEmHeight (family=0x4af8980, style=0, EmHeight=0x55ea50) returned 0x0 [0080.226] GdipGetLineSpacing (family=0x4af8980, style=0, LineSpacing=0x55ea50) returned 0x0 [0080.227] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.227] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.227] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41040000, style=0, unit=0x3, font=0x2378854) returned 0x0 [0080.227] GdipGetFontSize (font=0x4afef48, size=0x2378858) returned 0x0 [0080.228] GdipDeleteFont (font=0x4af1f08) returned 0x0 [0080.228] GetDC (hWnd=0x0) returned 0xf0105ee [0080.228] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eac4) returned 0x0 [0080.228] GdipGetFontHeight (font=0x4afef48, graphics=0x5c0f260, height=0x55eabc) returned 0x0 [0080.228] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.229] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.230] GetSystemMetrics (nIndex=5) returned 1 [0080.230] GetSystemMetrics (nIndex=6) returned 1 [0080.231] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.232] AdjustWindowRectEx (in: lpRect=0x55ebec, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55ebec) returned 1 [0080.232] GetDC (hWnd=0x0) returned 0xf0105ee [0080.232] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eac4) returned 0x0 [0080.232] GdipGetFontHeight (font=0x4afef48, graphics=0x5c0f260, height=0x55eabc) returned 0x0 [0080.232] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.232] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.233] GetSystemMetrics (nIndex=5) returned 1 [0080.233] GetSystemMetrics (nIndex=6) returned 1 [0080.233] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.233] AdjustWindowRectEx (in: lpRect=0x55ebec, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55ebec) returned 1 [0080.233] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.233] AdjustWindowRectEx (in: lpRect=0x55ebf0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf0) returned 1 [0080.262] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.267] AdjustWindowRectEx (in: lpRect=0x55ebf4, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf4) returned 1 [0080.302] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.302] AdjustWindowRectEx (in: lpRect=0x55ebf0, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ebf0) returned 1 [0080.309] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.309] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41de0000, style=1, unit=0x3, font=0x23790cc) returned 0x0 [0080.309] GdipGetFontSize (font=0x4af1f08, size=0x23790d0) returned 0x0 [0080.316] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.316] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.337] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2379870, nLength=0xc, lpnLengthNeeded=0x55ea2c | out: pvInfo=0x2379870, lpnLengthNeeded=0x55ea2c) returned 1 [0080.375] SetConsoleCtrlHandler (HandlerRoutine=0x49e065e, Add=1) returned 1 [0080.376] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0080.376] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0080.378] GetClassInfoW (in: hInstance=0x70000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x23798d4 | out: lpWndClass=0x23798d4) returned 0 [0080.380] CoTaskMemAlloc (cb=0x58) returned 0x76cb40 [0080.380] RegisterClassW (lpWndClass=0x55e97c) returned 0xc19d [0080.380] CoTaskMemFree (pv=0x76cb40) [0080.381] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x302be [0080.389] NtdllDefWindowProc_W (hWnd=0x302be, Msg=0x83, wParam=0x0, lParam=0x55e4a4) returned 0x0 [0080.389] NtdllDefWindowProc_W (hWnd=0x302be, Msg=0x1, wParam=0x0, lParam=0x55e4b8) returned 0x0 [0080.390] NtdllDefWindowProc_W (hWnd=0x302be, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0080.390] NtdllDefWindowProc_W (hWnd=0x302be, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0080.398] GetSysColor (nIndex=10) returned 0xb4b4b4 [0080.398] GetSysColor (nIndex=2) returned 0xd1b499 [0080.398] GetSysColor (nIndex=9) returned 0x0 [0080.398] GetSysColor (nIndex=12) returned 0xababab [0080.398] GetSysColor (nIndex=15) returned 0xf0f0f0 [0080.399] GetSysColor (nIndex=20) returned 0xffffff [0080.399] GetSysColor (nIndex=16) returned 0xa0a0a0 [0080.399] GetSysColor (nIndex=15) returned 0xf0f0f0 [0080.399] GetSysColor (nIndex=16) returned 0xa0a0a0 [0080.399] GetSysColor (nIndex=21) returned 0x696969 [0080.399] GetSysColor (nIndex=22) returned 0xe3e3e3 [0080.399] GetSysColor (nIndex=20) returned 0xffffff [0080.399] GetSysColor (nIndex=18) returned 0x0 [0080.399] GetSysColor (nIndex=1) returned 0x0 [0080.399] GetSysColor (nIndex=27) returned 0xead1b9 [0080.399] GetSysColor (nIndex=28) returned 0xf2e4d7 [0080.399] GetSysColor (nIndex=17) returned 0x6d6d6d [0080.399] GetSysColor (nIndex=13) returned 0xd77800 [0080.399] GetSysColor (nIndex=14) returned 0xffffff [0080.399] GetSysColor (nIndex=26) returned 0xcc6600 [0080.399] GetSysColor (nIndex=11) returned 0xfcf7f4 [0080.399] GetSysColor (nIndex=3) returned 0xdbcdbf [0080.399] GetSysColor (nIndex=19) returned 0x0 [0080.399] GetSysColor (nIndex=24) returned 0xe1ffff [0080.399] GetSysColor (nIndex=23) returned 0x0 [0080.399] GetSysColor (nIndex=4) returned 0xf0f0f0 [0080.400] GetSysColor (nIndex=30) returned 0xf0f0f0 [0080.400] GetSysColor (nIndex=29) returned 0xd77800 [0080.400] GetSysColor (nIndex=7) returned 0x0 [0080.400] GetSysColor (nIndex=0) returned 0xc8c8c8 [0080.400] GetSysColor (nIndex=5) returned 0xffffff [0080.400] GetSysColor (nIndex=6) returned 0x646464 [0080.400] GetSysColor (nIndex=8) returned 0x0 [0080.400] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.400] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.401] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.402] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41c00000, style=1, unit=0x3, font=0x2379e00) returned 0x0 [0080.402] GdipGetFontSize (font=0x5c0abd0, size=0x2379e04) returned 0x0 [0080.403] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.403] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.403] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.403] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.403] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.404] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41c00000, style=1, unit=0x3, font=0x237a084) returned 0x0 [0080.404] GdipGetFontSize (font=0x5c0abf8, size=0x237a088) returned 0x0 [0080.404] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.404] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.404] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.404] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.405] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.405] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41c00000, style=0, unit=0x3, font=0x237a33c) returned 0x0 [0080.405] GdipGetFontSize (font=0x5c0ac20, size=0x237a340) returned 0x0 [0080.405] GetDC (hWnd=0x0) returned 0xf0105ee [0080.405] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eb8c) returned 0x0 [0080.405] GdipGetFontHeight (font=0x5c0ac20, graphics=0x5c0f260, height=0x55eb84) returned 0x0 [0080.405] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.405] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.406] GetDC (hWnd=0x0) returned 0xf0105ee [0080.406] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eb1c) returned 0x0 [0080.406] GdipGetFontHeight (font=0x5c0ac20, graphics=0x5c0f260, height=0x55eb14) returned 0x0 [0080.406] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.407] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.407] GetSystemMetrics (nIndex=5) returned 1 [0080.407] GetSystemMetrics (nIndex=6) returned 1 [0080.407] GetSystemMetrics (nIndex=5) returned 1 [0080.407] GetSystemMetrics (nIndex=6) returned 1 [0080.407] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.407] AdjustWindowRectEx (in: lpRect=0x55eae0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eae0) returned 1 [0080.407] GetSystemMetrics (nIndex=5) returned 1 [0080.407] GetSystemMetrics (nIndex=6) returned 1 [0080.407] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.408] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eb50) returned 1 [0080.441] GetSystemMetrics (nIndex=5) returned 1 [0080.441] GetSystemMetrics (nIndex=6) returned 1 [0080.442] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.442] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x560108c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eb50) returned 1 [0080.443] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.443] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41c00000, style=0, unit=0x3, font=0x237a62c) returned 0x0 [0080.443] GdipGetFontSize (font=0x5c0ac48, size=0x237a630) returned 0x0 [0080.443] GetDC (hWnd=0x0) returned 0xf0105ee [0080.443] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eb8c) returned 0x0 [0080.444] GdipGetFontHeight (font=0x5c0ac48, graphics=0x5c0f260, height=0x55eb84) returned 0x0 [0080.444] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.444] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.444] GetDC (hWnd=0x0) returned 0xf0105ee [0080.444] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55eb1c) returned 0x0 [0080.444] GdipGetFontHeight (font=0x5c0ac48, graphics=0x5c0f260, height=0x55eb14) returned 0x0 [0080.444] GdipDeleteGraphics (graphics=0x5c0f260) returned 0x0 [0080.444] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0080.445] GetSystemMetrics (nIndex=5) returned 1 [0080.445] GetSystemMetrics (nIndex=6) returned 1 [0080.445] GetSystemMetrics (nIndex=5) returned 1 [0080.445] GetSystemMetrics (nIndex=6) returned 1 [0080.445] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.445] AdjustWindowRectEx (in: lpRect=0x55eae0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eae0) returned 1 [0080.445] GetSystemMetrics (nIndex=5) returned 1 [0080.445] GetSystemMetrics (nIndex=6) returned 1 [0080.445] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.446] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eb50) returned 1 [0080.446] GetSystemMetrics (nIndex=5) returned 1 [0080.446] GetSystemMetrics (nIndex=6) returned 1 [0080.446] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.446] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x560108c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55eb50) returned 1 [0080.446] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0080.446] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41de0000, style=1, unit=0x3, font=0x237a8dc) returned 0x0 [0080.446] GdipGetFontSize (font=0x5c0ac70, size=0x237a8e0) returned 0x0 [0080.447] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.447] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.447] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0080.447] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0080.458] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", nBufferLength=0x105, lpBuffer=0x55e484, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config", lpFilePart=0x0) returned 0x33 [0080.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e940) returned 1 [0080.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x55e9bc | out: lpFileInformation=0x55e9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0080.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e93c) returned 1 [0081.607] GdipLoadImageFromStream (stream=0x4840030, image=0x55e620) returned 0x0 [0081.985] GdipImageForceValidation (image=0x5c0f260) returned 0x0 [0082.219] GdipGetImageType (image=0x5c0f260, type=0x55e61c) returned 0x0 [0082.219] GdipGetImageRawFormat (image=0x5c0f260, format=0x55e590*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0082.223] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.224] AdjustWindowRectEx (in: lpRect=0x55eb7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb7c) returned 1 [0082.224] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.224] AdjustWindowRectEx (in: lpRect=0x55eb7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb7c) returned 1 [0082.226] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x55ebcc) returned 0x0 [0082.227] GdipCreateFont (fontFamily=0x4af8980, emSize=0x41c00000, style=1, unit=0x3, font=0x238f85c) returned 0x0 [0082.227] GdipGetFontSize (font=0x5c0ae68, size=0x238f860) returned 0x0 [0082.228] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.228] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0082.229] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.229] AdjustWindowRectEx (in: lpRect=0x55eb50, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55eb50) returned 1 [0082.231] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.231] AdjustWindowRectEx (in: lpRect=0x55ebb0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x55ebb0) returned 1 [0082.231] GetSystemMetrics (nIndex=59) returned 1460 [0082.231] GetSystemMetrics (nIndex=60) returned 920 [0082.231] GetSystemMetrics (nIndex=34) returned 136 [0082.231] GetSystemMetrics (nIndex=35) returned 39 [0082.232] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.232] AdjustWindowRectEx (in: lpRect=0x55eab0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x55eab0) returned 1 [0082.232] GetCurrentThreadId () returned 0x112c [0082.232] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.235] GetCurrentThreadId () returned 0x112c [0082.237] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.237] AdjustWindowRectEx (in: lpRect=0x55eac4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55eac4) returned 1 [0082.237] AdjustWindowRectEx (in: lpRect=0x55eb90, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55eb90) returned 1 [0082.239] CreateCompatibleDC (hdc=0x0) returned 0x5a01052a [0082.239] GetDC (hWnd=0x0) returned 0xf0105ee [0082.239] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0x55e9d8) returned 0x0 [0082.240] CoTaskMemAlloc (cb=0x5c) returned 0x7723b8 [0082.282] GdipGetLogFontW (font=0x4afef48, graphics=0x5c0fd70, logfontW=0x7723b8) returned 0x0 [0082.287] CoTaskMemFree (pv=0x7723b8) [0082.287] CoTaskMemAlloc (cb=0x5c) returned 0x772488 [0082.287] CoTaskMemFree (pv=0x772488) [0082.287] CoTaskMemAlloc (cb=0x5c) returned 0x772218 [0082.287] CoTaskMemFree (pv=0x772218) [0082.287] GdipDeleteGraphics (graphics=0x5c0fd70) returned 0x0 [0082.287] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0082.288] CoTaskMemAlloc (cb=0x5c) returned 0x771ed8 [0082.288] CreateFontIndirectW (lplf=0x771ed8) returned 0x2e0a067b [0082.288] CoTaskMemFree (pv=0x771ed8) [0082.288] SelectObject (hdc=0x5a01052a, h=0x2e0a067b) returned 0x8a01c2 [0082.288] GetTextMetricsW (in: hdc=0x5a01052a, lptm=0x55eae4 | out: lptm=0x55eae4) returned 1 [0082.289] GetTextExtentPoint32W (in: hdc=0x5a01052a, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2390854 | out: psizl=0x2390854) returned 1 [0082.292] SelectObject (hdc=0x5a01052a, h=0x8a01c2) returned 0x2e0a067b [0082.292] DeleteDC (hdc=0x5a01052a) returned 1 [0082.293] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.293] AdjustWindowRectEx (in: lpRect=0x55e84c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55e84c) returned 1 [0082.293] AdjustWindowRectEx (in: lpRect=0x55ea70, dwStyle=0x22cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55ea70) returned 1 [0082.295] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.295] AdjustWindowRectEx (in: lpRect=0x55e7c4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55e7c4) returned 1 [0082.295] AdjustWindowRectEx (in: lpRect=0x55e8a8, dwStyle=0x22cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55e8a8) returned 1 [0082.296] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.296] AdjustWindowRectEx (in: lpRect=0x55e754, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55e754) returned 1 [0082.296] AdjustWindowRectEx (in: lpRect=0x55e81c, dwStyle=0x22cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55e81c) returned 1 [0082.296] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.296] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.296] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.296] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.297] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.297] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.297] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.297] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.297] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.297] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55ea68) returned 1 [0082.298] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.298] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55e8cc) returned 1 [0082.298] GetSystemMetrics (nIndex=5) returned 1 [0082.298] GetSystemMetrics (nIndex=6) returned 1 [0082.298] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.298] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55ea68) returned 1 [0082.298] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.298] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55e8cc) returned 1 [0082.298] GetSystemMetrics (nIndex=5) returned 1 [0082.298] GetSystemMetrics (nIndex=6) returned 1 [0082.299] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.299] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.299] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.299] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.299] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.299] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.300] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.300] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.300] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.300] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.300] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.300] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.300] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.301] AdjustWindowRectEx (in: lpRect=0x55ea68, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55ea68) returned 1 [0082.301] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0082.301] AdjustWindowRectEx (in: lpRect=0x55e8cc, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e8cc) returned 1 [0082.304] GetCurrentActCtx (in: lphActCtx=0x55edec | out: lphActCtx=0x55edec*=0x0) returned 1 [0082.304] ActivateActCtx (in: hActCtx=0x769b1c, lpCookie=0x55edfc | out: hActCtx=0x769b1c, lpCookie=0x55edfc) returned 1 [0082.304] GetCurrentActCtx (in: lphActCtx=0x55ec0c | out: lphActCtx=0x55ec0c*=0x769b1c) returned 1 [0082.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.305] AdjustWindowRectEx (in: lpRect=0x55eb6c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55eb6c) returned 1 [0082.305] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.305] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Lol", dwStyle=0x22cf0000, X=-2147483648, Y=-2147483648, nWidth=954, nHeight=896, hWndParent=0x0, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x601e2 [0082.306] SetWindowLongW (hWnd=0x601e2, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0082.306] GetWindowLongW (hWnd=0x601e2, nIndex=-4) returned 1950089536 [0082.306] SetWindowLongW (hWnd=0x601e2, nIndex=-4, dwNewLong=77465950) returned 1950089536 [0082.306] GetWindowLongW (hWnd=0x601e2, nIndex=-4) returned 77465950 [0082.306] GetWindowLongW (hWnd=0x601e2, nIndex=-16) returned 651100160 [0082.306] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x81, wParam=0x0, lParam=0x55e630) returned 0x1 [0082.307] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x83, wParam=0x0, lParam=0x55e61c) returned 0x0 [0082.308] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x1, wParam=0x0, lParam=0x55e630) returned 0x0 [0082.308] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e2e8 | out: lpRect=0x55e2e8) returned 1 [0082.308] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e2e8 | out: lpRect=0x55e2e8) returned 1 [0082.312] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.312] AdjustWindowRectEx (in: lpRect=0x55e044, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e044) returned 1 [0082.313] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.313] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e018) returned 1 [0082.313] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.313] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e018) returned 1 [0082.313] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.313] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e018) returned 1 [0082.313] GetSystemMetrics (nIndex=5) returned 1 [0082.313] GetSystemMetrics (nIndex=6) returned 1 [0082.314] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.314] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55e018) returned 1 [0082.314] GetSystemMetrics (nIndex=5) returned 1 [0082.314] GetSystemMetrics (nIndex=6) returned 1 [0082.314] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.314] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x560108c1, bMenu=0, dwExStyle=0x200 | out: lpRect=0x55e018) returned 1 [0082.314] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.315] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e018) returned 1 [0082.315] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.315] AdjustWindowRectEx (in: lpRect=0x55e018, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x55e018) returned 1 [0082.317] SetWindowTextW (hWnd=0x601e2, lpString="Lol") returned 1 [0082.317] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xc, wParam=0x0, lParam=0x23775e8) returned 0x1 [0082.319] GetStartupInfoW (in: lpStartupInfo=0x2391758 | out: lpStartupInfo=0x2391758*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0082.320] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x46, wParam=0x0, lParam=0x55e644) returned 0x0 [0082.321] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x83, wParam=0x1, lParam=0x55e61c) returned 0x0 [0082.323] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e370 | out: lpwndpl=0x55e370) returned 1 [0082.323] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x47, wParam=0x0, lParam=0x55e644) returned 0x0 [0082.323] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x3, wParam=0x0, lParam=0x83008300) returned 0x0 [0082.323] GetClientRect (in: hWnd=0x601e2, lpRect=0x55dc70 | out: lpRect=0x55dc70) returned 1 [0082.323] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55dc70 | out: lpRect=0x55dc70) returned 1 [0082.323] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0082.323] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0082.324] GetSystemMetrics (nIndex=42) returned 0 [0082.324] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55dae4, nMaxCount=4 | out: lpString="Lol") returned 3 [0082.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55dae4) returned 0x3 [0082.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0082.324] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e320 | out: lpRect=0x55e320) returned 1 [0082.325] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e320 | out: lpRect=0x55e320) returned 1 [0082.330] GetParent (hWnd=0x601e2) returned 0x0 [0082.330] SetWindowLongW (hWnd=0x601e2, nIndex=-8, dwNewLong=0) returned 0 [0082.335] GetSystemMetrics (nIndex=11) returned 32 [0082.335] GetSystemMetrics (nIndex=12) returned 32 [0082.335] GetDC (hWnd=0x0) returned 0x10105d6 [0082.335] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0082.335] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0082.335] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0082.336] CreateIconFromResourceEx (presbits=0x2394248, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x402ad [0082.339] GetSystemMetrics (nIndex=49) returned 16 [0082.339] GetSystemMetrics (nIndex=50) returned 16 [0082.339] CreateIconFromResourceEx (presbits=0x239532c, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xe0213 [0082.341] SendMessageW (hWnd=0x601e2, Msg=0x80, wParam=0x0, lParam=0xe0213) returned 0x0 [0082.341] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x80, wParam=0x0, lParam=0xe0213) returned 0x0 [0082.342] SendMessageW (hWnd=0x601e2, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0082.342] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0082.343] GetSystemMenu (hWnd=0x601e2, bRevert=0) returned 0x601ed [0082.346] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55ec1c | out: lpwndpl=0x55ec1c) returned 1 [0082.346] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0082.346] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0082.346] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0082.346] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0082.346] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0082.347] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.347] GetWindowLongW (hWnd=0x601e2, nIndex=-16) returned 651100160 [0082.347] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0082.347] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0082.347] GetSystemMetrics (nIndex=42) returned 0 [0082.347] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55eb68, nMaxCount=4 | out: lpString="Lol") returned 3 [0082.347] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55eb68) returned 0x3 [0082.347] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0082.348] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0082.348] GetSystemMetrics (nIndex=42) returned 0 [0082.348] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55eb68, nMaxCount=4 | out: lpString="Lol") returned 3 [0082.348] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55eb68) returned 0x3 [0082.348] AdjustWindowRectEx (in: lpRect=0x55ebac, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x55ebac) returned 1 [0082.348] GetWindowLongW (hWnd=0x601e2, nIndex=-16) returned 651100160 [0082.348] GetWindowLongW (hWnd=0x601e2, nIndex=-20) returned 328064 [0082.348] SetWindowLongW (hWnd=0x601e2, nIndex=-16, dwNewLong=583991296) returned 651100160 [0082.348] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7c, wParam=0xfffffff0, lParam=0x55ebbc) returned 0x0 [0082.349] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7d, wParam=0xfffffff0, lParam=0x55ebbc) returned 0x0 [0082.349] SetWindowLongW (hWnd=0x601e2, nIndex=-20, dwNewLong=327808) returned 328064 [0082.349] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7c, wParam=0xffffffec, lParam=0x55ebbc) returned 0x0 [0082.350] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7d, wParam=0xffffffec, lParam=0x55ebbc) returned 0x0 [0082.350] SetWindowPos (hWnd=0x601e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0082.351] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x46, wParam=0x0, lParam=0x55ebd4) returned 0x0 [0082.351] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x83, wParam=0x1, lParam=0x55ebac) returned 0x0 [0082.353] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e900 | out: lpwndpl=0x55e900) returned 1 [0082.353] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x47, wParam=0x0, lParam=0x55ebd4) returned 0x0 [0082.353] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e8b0 | out: lpRect=0x55e8b0) returned 1 [0082.353] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e8b0 | out: lpRect=0x55e8b0) returned 1 [0082.355] RedrawWindow (hWnd=0x601e2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0082.355] GetSystemMenu (hWnd=0x601e2, bRevert=0) returned 0x601ed [0082.355] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55ec0c | out: lpwndpl=0x55ec0c) returned 1 [0082.355] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0082.355] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0082.355] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0082.355] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0082.356] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0082.356] ShowWindow (hWnd=0x601e2, nCmdShow=2) returned 0 [0082.356] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x46, wParam=0x0, lParam=0x55ec84) returned 0x0 [0082.367] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e9b0 | out: lpwndpl=0x55e9b0) returned 1 [0082.367] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x47, wParam=0x0, lParam=0x55ec84) returned 0x0 [0082.367] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e960 | out: lpRect=0x55e960) returned 1 [0082.367] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e960 | out: lpRect=0x55e960) returned 1 [0082.368] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0082.368] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0082.368] GetSystemMetrics (nIndex=42) returned 0 [0082.368] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55eb78, nMaxCount=4 | out: lpString="Lol") returned 3 [0082.368] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55eb78) returned 0x3 [0082.368] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0082.369] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.369] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x239598c | out: lpWndClass=0x239598c) returned 1 [0082.370] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.371] CoTaskMemAlloc (cb=0x56) returned 0x76cde0 [0082.371] RegisterClassW (lpWndClass=0x55ea20) returned 0xc19e [0082.371] CoTaskMemFree (pv=0x76cde0) [0082.371] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.371] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName=".", dwStyle=0x5600000d, X=12, Y=-80, nWidth=0, nHeight=71, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x7002e [0082.372] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0082.372] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 1874504640 [0082.372] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=77466030) returned 1874504640 [0082.372] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 77466030 [0082.372] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 1174405133 [0082.372] GetWindowLongW (hWnd=0x7002e, nIndex=-12) returned 0 [0082.372] SetWindowLongW (hWnd=0x7002e, nIndex=-12, dwNewLong=458798) returned 0 [0082.373] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0082.376] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0082.376] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0082.378] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x0 [0082.378] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0082.378] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0082.378] GetParent (hWnd=0x7002e) returned 0x601e2 [0082.378] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e23c, cPoints=0x2 | out: lpPoints=0x55e23c) returned 2097184000 [0082.378] SetWindowTextW (hWnd=0x7002e, lpString=".") returned 1 [0082.378] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0xc, wParam=0x0, lParam=0x23775c0) returned 0x1 [0082.379] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x5, wParam=0x0, lParam=0x470000) returned 0x0 [0082.379] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0xffb0000c) returned 0x0 [0082.379] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0082.379] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0082.379] GetParent (hWnd=0x7002e) returned 0x601e2 [0082.379] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e294, cPoints=0x2 | out: lpPoints=0x55e294) returned 2097184000 [0082.379] SendMessageW (hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0082.379] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0082.379] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0082.380] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0082.383] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0082.383] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0082.383] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0082.383] GetParent (hWnd=0x7002e) returned 0x601e2 [0082.383] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e264, cPoints=0x2 | out: lpPoints=0x55e264) returned 2097184000 [0082.383] GetParent (hWnd=0x7002e) returned 0x601e2 [0082.383] GetParent (hWnd=0x7002e) returned 0x601e2 [0082.383] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0082.384] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.384] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.384] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="In order to recover your data...", dwStyle=0x5600000d, X=12, Y=-377, nWidth=0, nHeight=87, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x70036 [0082.384] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0082.385] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 1874504640 [0082.385] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=77466070) returned 1874504640 [0082.385] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 77466070 [0082.385] GetWindowLongW (hWnd=0x70036, nIndex=-16) returned 1174405133 [0082.385] GetWindowLongW (hWnd=0x70036, nIndex=-12) returned 0 [0082.385] SetWindowLongW (hWnd=0x70036, nIndex=-12, dwNewLong=458806) returned 0 [0082.385] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0082.386] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0082.386] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0082.387] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x7002e [0082.387] GetClientRect (in: hWnd=0x70036, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0082.387] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0082.387] GetParent (hWnd=0x70036) returned 0x601e2 [0082.387] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e23c, cPoints=0x2 | out: lpPoints=0x55e23c) returned 2097184000 [0082.387] SetWindowTextW (hWnd=0x70036, lpString="In order to recover your data...") returned 1 [0082.387] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xc, wParam=0x0, lParam=0x2377500) returned 0x1 [0082.388] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x5, wParam=0x0, lParam=0x570000) returned 0x0 [0082.388] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe87000c) returned 0x0 [0082.388] GetClientRect (in: hWnd=0x70036, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0082.389] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0082.389] GetParent (hWnd=0x70036) returned 0x601e2 [0082.389] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e294, cPoints=0x2 | out: lpPoints=0x55e294) returned 2097184000 [0082.389] SendMessageW (hWnd=0x70036, Msg=0x2210, wParam=0x360001, lParam=0x70036) returned 0x0 [0082.389] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x2210, wParam=0x360001, lParam=0x70036) returned 0x0 [0082.390] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0082.390] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0082.391] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0082.391] GetClientRect (in: hWnd=0x70036, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0082.391] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0082.391] GetParent (hWnd=0x70036) returned 0x601e2 [0082.391] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e264, cPoints=0x2 | out: lpPoints=0x55e264) returned 2097184000 [0082.391] GetParent (hWnd=0x70036) returned 0x601e2 [0082.392] GetParent (hWnd=0x70036) returned 0x601e2 [0082.392] GetCurrentActCtx (in: lphActCtx=0x55eb54 | out: lphActCtx=0x55eb54*=0x769b1c) returned 1 [0082.392] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0082.392] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x2395da0 | out: lpWndClass=0x2395da0) returned 1 [0082.393] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.393] CoTaskMemAlloc (cb=0x52) returned 0x76cea0 [0082.393] RegisterClassW (lpWndClass=0x55ea08) returned 0xc1a0 [0082.394] CoTaskMemFree (pv=0x76cea0) [0082.394] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0082.394] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="friendly.cyber.criminal@gmail.com", dwStyle=0x560108c1, X=-333, Y=-127, nWidth=677, nHeight=44, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x70030 [0082.394] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=1874383968) returned 77466110 [0082.394] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 1874383968 [0082.395] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=77466150) returned 1874383968 [0082.395] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 77466150 [0082.395] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 1174472897 [0082.395] GetWindowLongW (hWnd=0x70030, nIndex=-12) returned 0 [0082.395] SetWindowLongW (hWnd=0x70030, nIndex=-12, dwNewLong=458800) returned 0 [0082.395] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x81, wParam=0x0, lParam=0x55e578) returned 0x1 [0082.403] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0x55e564) returned 0x0 [0082.403] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0x55e578) returned 0x1 [0090.586] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x4000030, lParam=0x70030) returned 0x0 [0090.586] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x3000030, lParam=0x70030) returned 0x0 [0090.587] SendMessageW (hWnd=0x70030, Msg=0x2055, wParam=0x70030, lParam=0x3) returned 0x2 [0090.587] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0090.587] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x70036 [0090.587] GetClientRect (in: hWnd=0x70030, lpRect=0x55e238 | out: lpRect=0x55e238) returned 1 [0090.587] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e238 | out: lpRect=0x55e238) returned 1 [0090.587] GetParent (hWnd=0x70030) returned 0x601e2 [0090.587] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e238, cPoints=0x2 | out: lpPoints=0x55e238) returned 2097184000 [0090.587] GetDC (hWnd=0x0) returned 0x10105d6 [0090.587] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x55e0d4) returned 0x0 [0090.588] CoTaskMemAlloc (cb=0x5c) returned 0x771ed8 [0090.588] GdipGetLogFontW (font=0x5c0ac48, graphics=0x5c0fd70, logfontW=0x771ed8) returned 0x0 [0090.588] CoTaskMemFree (pv=0x771ed8) [0090.588] CoTaskMemAlloc (cb=0x5c) returned 0x772488 [0090.588] CoTaskMemFree (pv=0x772488) [0090.588] CoTaskMemAlloc (cb=0x5c) returned 0x772558 [0090.588] CoTaskMemFree (pv=0x772558) [0090.588] GdipDeleteGraphics (graphics=0x5c0fd70) returned 0x0 [0090.589] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0090.589] CoTaskMemAlloc (cb=0x5c) returned 0x7720e0 [0090.589] CreateFontIndirectW (lplf=0x7720e0) returned 0xf0a07e9 [0090.589] CoTaskMemFree (pv=0x7720e0) [0090.589] SendMessageW (hWnd=0x70030, Msg=0x30, wParam=0xf0a07e9, lParam=0x0) returned 0x1 [0090.589] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x30, wParam=0xf0a07e9, lParam=0x0) returned 0x1 [0090.615] SendMessageW (hWnd=0x70030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0090.615] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0090.616] SetWindowTextW (hWnd=0x70030, lpString="friendly.cyber.criminal@gmail.com") returned 1 [0090.616] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xc, wParam=0x0, lParam=0x2377494) returned 0x1 [0090.616] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x4000030, lParam=0x70030) returned 0x0 [0090.616] SendMessageW (hWnd=0x70030, Msg=0x2111, wParam=0x3000030, lParam=0x70030) returned 0x0 [0090.618] GetSystemMetrics (nIndex=5) returned 1 [0090.618] GetSystemMetrics (nIndex=6) returned 1 [0090.618] SendMessageW (hWnd=0x70030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0090.618] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0090.620] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x5, wParam=0x0, lParam=0x2802a1) returned 0x0 [0090.620] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff83feb5) returned 0x0 [0090.620] GetClientRect (in: hWnd=0x70030, lpRect=0x55e290 | out: lpRect=0x55e290) returned 1 [0090.620] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e290 | out: lpRect=0x55e290) returned 1 [0090.620] GetParent (hWnd=0x70030) returned 0x601e2 [0090.620] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e290, cPoints=0x2 | out: lpPoints=0x55e290) returned 2097184000 [0090.620] SendMessageW (hWnd=0x70030, Msg=0x2210, wParam=0x300001, lParam=0x70030) returned 0x0 [0090.620] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x2210, wParam=0x300001, lParam=0x70030) returned 0x0 [0090.620] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.620] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e58c) returned 0x0 [0090.634] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e58c) returned 0x0 [0090.634] GetClientRect (in: hWnd=0x70030, lpRect=0x55e260 | out: lpRect=0x55e260) returned 1 [0090.634] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e260 | out: lpRect=0x55e260) returned 1 [0090.634] GetParent (hWnd=0x70030) returned 0x601e2 [0090.634] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e260, cPoints=0x2 | out: lpPoints=0x55e260) returned 2097184000 [0090.634] GetParent (hWnd=0x70030) returned 0x601e2 [0090.634] GetParent (hWnd=0x70030) returned 0x601e2 [0090.634] GetCurrentActCtx (in: lphActCtx=0x55eb54 | out: lphActCtx=0x55eb54*=0x769b1c) returned 1 [0090.635] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0090.647] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0090.647] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1", dwStyle=0x560108c1, X=-333, Y=-232, nWidth=677, nHeight=44, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x502b6 [0090.648] SetWindowLongW (hWnd=0x502b6, nIndex=-4, dwNewLong=1874383968) returned 77466110 [0090.648] GetWindowLongW (hWnd=0x502b6, nIndex=-4) returned 1874383968 [0090.649] SetWindowLongW (hWnd=0x502b6, nIndex=-4, dwNewLong=77466190) returned 1874383968 [0090.649] GetWindowLongW (hWnd=0x502b6, nIndex=-4) returned 77466190 [0090.649] GetWindowLongW (hWnd=0x502b6, nIndex=-16) returned 1174472897 [0090.649] GetWindowLongW (hWnd=0x502b6, nIndex=-12) returned 0 [0090.649] SetWindowLongW (hWnd=0x502b6, nIndex=-12, dwNewLong=328374) returned 0 [0090.649] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x81, wParam=0x0, lParam=0x55e578) returned 0x1 [0090.651] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x83, wParam=0x0, lParam=0x55e564) returned 0x0 [0090.652] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x1, wParam=0x0, lParam=0x55e578) returned 0x1 [0090.653] SendMessageW (hWnd=0x502b6, Msg=0x2111, wParam=0x40002b6, lParam=0x502b6) returned 0x0 [0090.653] SendMessageW (hWnd=0x502b6, Msg=0x2111, wParam=0x30002b6, lParam=0x502b6) returned 0x0 [0090.653] SendMessageW (hWnd=0x502b6, Msg=0x2055, wParam=0x502b6, lParam=0x3) returned 0x2 [0090.653] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0090.653] GetWindow (hWnd=0x502b6, uCmd=0x3) returned 0x70030 [0090.653] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e238 | out: lpRect=0x55e238) returned 1 [0090.653] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e238 | out: lpRect=0x55e238) returned 1 [0090.653] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.653] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e238, cPoints=0x2 | out: lpPoints=0x55e238) returned 2097184000 [0090.654] GetDC (hWnd=0x0) returned 0x10105d6 [0090.654] GdipCreateFromHDC (hdc=0x10105d6, graphics=0x55e0d4) returned 0x0 [0090.654] CoTaskMemAlloc (cb=0x5c) returned 0x772218 [0090.654] GdipGetLogFontW (font=0x5c0ac20, graphics=0x5c0fd70, logfontW=0x772218) returned 0x0 [0090.654] CoTaskMemFree (pv=0x772218) [0090.654] CoTaskMemAlloc (cb=0x5c) returned 0x772558 [0090.654] CoTaskMemFree (pv=0x772558) [0090.654] CoTaskMemAlloc (cb=0x5c) returned 0x771ed8 [0090.655] CoTaskMemFree (pv=0x771ed8) [0090.655] GdipDeleteGraphics (graphics=0x5c0fd70) returned 0x0 [0090.655] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0090.655] CoTaskMemAlloc (cb=0x5c) returned 0x772558 [0090.655] CreateFontIndirectW (lplf=0x772558) returned 0x810a07dc [0090.655] CoTaskMemFree (pv=0x772558) [0090.655] SendMessageW (hWnd=0x502b6, Msg=0x30, wParam=0x810a07dc, lParam=0x0) returned 0x1 [0090.655] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x30, wParam=0x810a07dc, lParam=0x0) returned 0x1 [0090.656] SendMessageW (hWnd=0x502b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0090.656] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0090.657] SetWindowTextW (hWnd=0x502b6, lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") returned 1 [0090.657] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xc, wParam=0x0, lParam=0x2377414) returned 0x1 [0090.657] SendMessageW (hWnd=0x502b6, Msg=0x2111, wParam=0x40002b6, lParam=0x502b6) returned 0x0 [0090.657] SendMessageW (hWnd=0x502b6, Msg=0x2111, wParam=0x30002b6, lParam=0x502b6) returned 0x0 [0090.657] GetSystemMetrics (nIndex=5) returned 1 [0090.657] GetSystemMetrics (nIndex=6) returned 1 [0090.657] SendMessageW (hWnd=0x502b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0090.657] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0090.658] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x5, wParam=0x0, lParam=0x2802a1) returned 0x0 [0090.658] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0090.658] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e290 | out: lpRect=0x55e290) returned 1 [0090.658] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e290 | out: lpRect=0x55e290) returned 1 [0090.658] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.658] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e290, cPoints=0x2 | out: lpPoints=0x55e290) returned 2097184000 [0090.658] SendMessageW (hWnd=0x502b6, Msg=0x2210, wParam=0x2b60001, lParam=0x502b6) returned 0x0 [0090.658] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x2210, wParam=0x2b60001, lParam=0x502b6) returned 0x0 [0090.659] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.659] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e58c) returned 0x0 [0090.660] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e58c) returned 0x0 [0090.660] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e260 | out: lpRect=0x55e260) returned 1 [0090.660] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e260 | out: lpRect=0x55e260) returned 1 [0090.660] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.660] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e260, cPoints=0x2 | out: lpPoints=0x55e260) returned 2097184000 [0090.661] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.661] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.661] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0090.661] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0090.661] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0090.662] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Next, E-mail your transaction ID to the following address:", dwStyle=0x5600000d, X=12, Y=-185, nWidth=0, nHeight=55, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x18001c [0090.662] SetWindowLongW (hWnd=0x18001c, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0090.662] GetWindowLongW (hWnd=0x18001c, nIndex=-4) returned 1874504640 [0090.663] SetWindowLongW (hWnd=0x18001c, nIndex=-4, dwNewLong=77466230) returned 1874504640 [0090.663] GetWindowLongW (hWnd=0x18001c, nIndex=-4) returned 77466230 [0090.663] GetWindowLongW (hWnd=0x18001c, nIndex=-16) returned 1174405133 [0090.663] GetWindowLongW (hWnd=0x18001c, nIndex=-12) returned 0 [0090.663] SetWindowLongW (hWnd=0x18001c, nIndex=-12, dwNewLong=1572892) returned 0 [0090.663] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0090.664] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0090.664] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0090.664] GetWindow (hWnd=0x18001c, uCmd=0x3) returned 0x502b6 [0090.665] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.665] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.666] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.666] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e23c, cPoints=0x2 | out: lpPoints=0x55e23c) returned 2097184000 [0090.667] SetWindowTextW (hWnd=0x18001c, lpString="Next, E-mail your transaction ID to the following address:") returned 1 [0090.667] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0xc, wParam=0x0, lParam=0x2377360) returned 0x1 [0090.667] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0090.667] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xff47000c) returned 0x0 [0090.668] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.668] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.668] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.668] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e294, cPoints=0x2 | out: lpPoints=0x55e294) returned 2097184000 [0090.668] SendMessageW (hWnd=0x18001c, Msg=0x2210, wParam=0x1c0001, lParam=0x18001c) returned 0x0 [0090.668] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x2210, wParam=0x1c0001, lParam=0x18001c) returned 0x0 [0090.668] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.669] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.670] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.670] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.670] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.670] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.670] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e264, cPoints=0x2 | out: lpPoints=0x55e264) returned 2097184000 [0090.670] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.670] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.671] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0090.671] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0090.671] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0090.671] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Please send n Bitcoin(s) to the following BTC address:", dwStyle=0x5600000d, X=12, Y=-290, nWidth=0, nHeight=55, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x202c8 [0090.672] SetWindowLongW (hWnd=0x202c8, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0090.672] GetWindowLongW (hWnd=0x202c8, nIndex=-4) returned 1874504640 [0090.672] SetWindowLongW (hWnd=0x202c8, nIndex=-4, dwNewLong=77466270) returned 1874504640 [0090.672] GetWindowLongW (hWnd=0x202c8, nIndex=-4) returned 77466270 [0090.672] GetWindowLongW (hWnd=0x202c8, nIndex=-16) returned 1174405133 [0090.672] GetWindowLongW (hWnd=0x202c8, nIndex=-12) returned 0 [0090.672] SetWindowLongW (hWnd=0x202c8, nIndex=-12, dwNewLong=131784) returned 0 [0090.673] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0090.673] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0090.673] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0090.674] GetWindow (hWnd=0x202c8, uCmd=0x3) returned 0x18001c [0090.674] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.674] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.674] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.674] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e23c, cPoints=0x2 | out: lpPoints=0x55e23c) returned 2097184000 [0090.674] SetWindowTextW (hWnd=0x202c8, lpString="Please send n Bitcoin(s) to the following BTC address:") returned 1 [0090.674] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0xc, wParam=0x0, lParam=0x23772c8) returned 0x1 [0090.675] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0090.675] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x3, wParam=0x0, lParam=0xfede000c) returned 0x0 [0090.675] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.675] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.675] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.675] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e294, cPoints=0x2 | out: lpPoints=0x55e294) returned 2097184000 [0090.675] SendMessageW (hWnd=0x202c8, Msg=0x2210, wParam=0x2c80001, lParam=0x202c8) returned 0x0 [0090.675] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x2210, wParam=0x2c80001, lParam=0x202c8) returned 0x0 [0090.676] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.676] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.677] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.677] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.677] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.677] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.677] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e264, cPoints=0x2 | out: lpPoints=0x55e264) returned 2097184000 [0090.677] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.678] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.678] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0090.678] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0090.678] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0090.678] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Your files (count: n) have been encrypted!", dwStyle=0x5600000d, X=12, Y=-432, nWidth=0, nHeight=55, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x300ec [0090.679] SetWindowLongW (hWnd=0x300ec, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0090.679] GetWindowLongW (hWnd=0x300ec, nIndex=-4) returned 1874504640 [0090.679] SetWindowLongW (hWnd=0x300ec, nIndex=-4, dwNewLong=77466310) returned 1874504640 [0090.679] GetWindowLongW (hWnd=0x300ec, nIndex=-4) returned 77466310 [0090.679] GetWindowLongW (hWnd=0x300ec, nIndex=-16) returned 1174405133 [0090.679] GetWindowLongW (hWnd=0x300ec, nIndex=-12) returned 0 [0090.679] SetWindowLongW (hWnd=0x300ec, nIndex=-12, dwNewLong=196844) returned 0 [0090.680] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0090.681] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0090.681] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0090.682] GetWindow (hWnd=0x300ec, uCmd=0x3) returned 0x202c8 [0090.682] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.682] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e23c | out: lpRect=0x55e23c) returned 1 [0090.682] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.682] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e23c, cPoints=0x2 | out: lpPoints=0x55e23c) returned 2097184000 [0090.682] SetWindowTextW (hWnd=0x300ec, lpString="Your files (count: n) have been encrypted!") returned 1 [0090.682] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0xc, wParam=0x0, lParam=0x2377234) returned 0x1 [0090.683] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x5, wParam=0x0, lParam=0x370000) returned 0x0 [0090.683] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x3, wParam=0x0, lParam=0xfe50000c) returned 0x0 [0090.683] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.683] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e294 | out: lpRect=0x55e294) returned 1 [0090.683] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.683] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e294, cPoints=0x2 | out: lpPoints=0x55e294) returned 2097184000 [0090.683] SendMessageW (hWnd=0x300ec, Msg=0x2210, wParam=0xec0001, lParam=0x300ec) returned 0x0 [0090.683] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x2210, wParam=0xec0001, lParam=0x300ec) returned 0x0 [0090.683] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.684] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.685] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.685] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.685] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e264 | out: lpRect=0x55e264) returned 1 [0090.685] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.685] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e264, cPoints=0x2 | out: lpPoints=0x55e264) returned 2097184000 [0090.685] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.685] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.685] GetCurrentActCtx (in: lphActCtx=0x55eb6c | out: lphActCtx=0x55eb6c*=0x769b1c) returned 1 [0090.686] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0090.686] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0090.686] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=298, Y=12, nWidth=0, nHeight=0, hWndParent=0x601e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x502c2 [0090.687] SetWindowLongW (hWnd=0x502c2, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0090.687] GetWindowLongW (hWnd=0x502c2, nIndex=-4) returned 1950089536 [0090.687] SetWindowLongW (hWnd=0x502c2, nIndex=-4, dwNewLong=77466350) returned 1950089536 [0090.687] GetWindowLongW (hWnd=0x502c2, nIndex=-4) returned 77466350 [0090.687] GetWindowLongW (hWnd=0x502c2, nIndex=-16) returned 1174405120 [0090.687] GetWindowLongW (hWnd=0x502c2, nIndex=-12) returned 0 [0090.687] SetWindowLongW (hWnd=0x502c2, nIndex=-12, dwNewLong=328386) returned 0 [0090.687] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x81, wParam=0x0, lParam=0x55e590) returned 0x1 [0090.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x83, wParam=0x0, lParam=0x55e57c) returned 0x0 [0090.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x1, wParam=0x0, lParam=0x55e590) returned 0x0 [0090.688] GetWindow (hWnd=0x502c2, uCmd=0x3) returned 0x300ec [0090.688] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e278 | out: lpRect=0x55e278) returned 1 [0090.688] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e278 | out: lpRect=0x55e278) returned 1 [0090.688] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.688] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e278, cPoints=0x2 | out: lpPoints=0x55e278) returned 2097184000 [0090.689] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0090.689] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x3, wParam=0x0, lParam=0xc012a) returned 0x0 [0090.689] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e2d0 | out: lpRect=0x55e2d0) returned 1 [0090.689] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e2d0 | out: lpRect=0x55e2d0) returned 1 [0090.689] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.689] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e2d0, cPoints=0x2 | out: lpPoints=0x55e2d0) returned 2097184000 [0090.689] SendMessageW (hWnd=0x502c2, Msg=0x2210, wParam=0x2c20001, lParam=0x502c2) returned 0x0 [0090.689] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x2210, wParam=0x2c20001, lParam=0x502c2) returned 0x0 [0090.690] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.690] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x46, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.691] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x47, wParam=0x0, lParam=0x55e5a4) returned 0x0 [0090.691] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e2a0 | out: lpRect=0x55e2a0) returned 1 [0090.691] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e2a0 | out: lpRect=0x55e2a0) returned 1 [0090.691] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.691] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e2a0, cPoints=0x2 | out: lpPoints=0x55e2a0) returned 2097184000 [0090.691] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.692] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.710] GdipImageGetFrameDimensionsCount (image=0x5c0f260, count=0x55eb48) returned 0x0 [0090.710] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x78a978 [0090.711] GdipImageGetFrameDimensionsList (image=0x5c0f260, dimensionIDs=0x78a978*(Data1=0x0, Data2=0x4, Data3=0x0, Data4=([0]=0x4, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0090.714] LocalFree (hMem=0x78a978) returned 0x0 [0090.716] SendMessageW (hWnd=0x601e2, Msg=0x18, wParam=0x1, lParam=0x0) [0090.717] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0090.717] GetParent (hWnd=0x7002e) returned 0x601e2 [0090.717] GetParent (hWnd=0x70036) returned 0x601e2 [0090.717] GetParent (hWnd=0x70030) returned 0x601e2 [0090.717] GetParent (hWnd=0x502b6) returned 0x601e2 [0090.717] GetParent (hWnd=0x18001c) returned 0x601e2 [0090.717] GetParent (hWnd=0x202c8) returned 0x601e2 [0090.717] GetParent (hWnd=0x300ec) returned 0x601e2 [0090.717] GetParent (hWnd=0x502c2) returned 0x601e2 [0090.717] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0090.717] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0090.717] GetSystemMetrics (nIndex=42) returned 0 [0090.718] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55e8dc, nMaxCount=4 | out: lpString="Lol") returned 3 [0090.718] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55e8dc) returned 0x3 [0091.091] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0091.091] GetWindowLongW (hWnd=0x601e2, nIndex=-16) returned 919535616 [0091.091] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0091.091] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0091.091] GetSystemMetrics (nIndex=42) returned 0 [0091.092] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55e7b8, nMaxCount=4 | out: lpString="Lol") returned 3 [0091.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55e7b8) returned 0x3 [0091.092] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0091.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0091.092] GetSystemMetrics (nIndex=42) returned 0 [0091.092] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55e7b8, nMaxCount=4 | out: lpString="Lol") returned 3 [0091.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55e7b8) returned 0x3 [0091.092] AdjustWindowRectEx (in: lpRect=0x55e7fc, dwStyle=0x12cf0000, bMenu=0, dwExStyle=0xd0080 | out: lpRect=0x55e7fc) returned 1 [0091.092] GetWindowLongW (hWnd=0x601e2, nIndex=-16) returned 919535616 [0091.092] GetWindowLongW (hWnd=0x601e2, nIndex=-20) returned 328064 [0091.092] SetWindowLongW (hWnd=0x601e2, nIndex=-16, dwNewLong=852426752) returned 919535616 [0091.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7c, wParam=0xfffffff0, lParam=0x55e80c) returned 0x0 [0091.093] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7d, wParam=0xfffffff0, lParam=0x55e80c) returned 0x0 [0091.094] SetWindowLongW (hWnd=0x601e2, nIndex=-20, dwNewLong=852096) returned 328064 [0091.094] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7c, wParam=0xffffffec, lParam=0x55e80c) returned 0x0 [0091.095] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x7d, wParam=0xffffffec, lParam=0x55e80c) returned 0x0 [0091.095] SetWindowPos (hWnd=0x601e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0091.098] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x46, wParam=0x0, lParam=0x55e824) returned 0x0 [0091.099] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x83, wParam=0x1, lParam=0x55e7fc) returned 0x0 [0091.100] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e550 | out: lpwndpl=0x55e550) returned 1 [0091.100] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x47, wParam=0x0, lParam=0x55e824) returned 0x0 [0091.100] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e500 | out: lpRect=0x55e500) returned 1 [0091.100] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e500 | out: lpRect=0x55e500) returned 1 [0091.101] RedrawWindow (hWnd=0x601e2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0091.101] GetSystemMenu (hWnd=0x601e2, bRevert=0) returned 0x601ed [0091.101] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e85c | out: lpwndpl=0x55e85c) returned 1 [0091.101] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0091.102] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0091.102] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0091.102] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0091.102] EnableMenuItem (hMenu=0x601ed, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0091.142] SetLayeredWindowAttributes (hwnd=0x601e2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0091.143] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e92c | out: lpwndpl=0x55e92c) returned 1 [0091.146] GetCurrentThreadId () returned 0x112c [0091.155] EnumThreadWindows (dwThreadId=0x112c, lpfn=0x49e04b6, lParam=0x601e2) returned 1 [0091.231] GetWindowLongW (hWnd=0x302be, nIndex=-8) returned 0 [0091.231] GetWindowLongW (hWnd=0x601e2, nIndex=-8) returned 0 [0091.231] GetWindowLongW (hWnd=0x502a4, nIndex=-8) returned 197310 [0091.237] GetParent (hWnd=0x601e2) returned 0x0 [0091.240] GetWindowThreadProcessId (in: hWnd=0x7002e, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.608] GetCurrentActCtx (in: lphActCtx=0x55e7dc | out: lphActCtx=0x55e7dc*=0x769b1c) returned 1 [0091.609] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0091.609] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0091.609] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x202cc [0091.610] SetWindowLongW (hWnd=0x202cc, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0091.610] GetWindowLongW (hWnd=0x202cc, nIndex=-4) returned 1950089536 [0091.611] SetWindowLongW (hWnd=0x202cc, nIndex=-4, dwNewLong=77479310) returned 1950089536 [0091.611] GetWindowLongW (hWnd=0x202cc, nIndex=-4) returned 77479310 [0091.611] GetWindowLongW (hWnd=0x202cc, nIndex=-16) returned 113311744 [0091.611] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202cc, Msg=0x24, wParam=0x0, lParam=0x55e20c) returned 0x0 [0091.617] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202cc, Msg=0x81, wParam=0x0, lParam=0x55e200) returned 0x1 [0091.778] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202cc, Msg=0x83, wParam=0x0, lParam=0x55e1ec) returned 0x0 [0091.778] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202cc, Msg=0x1, wParam=0x0, lParam=0x55e200) returned 0x0 [0091.778] GetClientRect (in: hWnd=0x202cc, lpRect=0x55decc | out: lpRect=0x55decc) returned 1 [0091.778] GetWindowRect (in: hWnd=0x202cc, lpRect=0x55decc | out: lpRect=0x55decc) returned 1 [0091.779] SetWindowTextW (hWnd=0x202cc, lpString="WindowsFormsParkingWindow") returned 1 [0091.779] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x202cc, Msg=0xc, wParam=0x0, lParam=0x239714c) returned 0x1 [0091.780] GetParent (hWnd=0x202cc) returned 0x0 [0091.780] SetParent (hWndChild=0x7002e, hWndNewParent=0x202cc) returned 0x601e2 [0091.780] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.780] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.783] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.783] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.783] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.783] GetParent (hWnd=0x7002e) returned 0x601e2 [0091.783] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned 2097184000 [0091.783] GetParent (hWnd=0x7002e) returned 0x601e2 [0091.783] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.785] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.785] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.785] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0xffb0000c) returned 0x0 [0091.785] GetClientRect (in: hWnd=0x7002e, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.785] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.785] GetParent (hWnd=0x7002e) returned 0x202cc [0091.785] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd64, cPoints=0x2 | out: lpPoints=0x55dd64) returned -1966088 [0091.785] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.785] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.785] GetParent (hWnd=0x7002e) returned 0x202cc [0091.786] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned -1966088 [0091.786] GetParent (hWnd=0x7002e) returned 0x202cc [0091.786] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.786] GetWindowThreadProcessId (in: hWnd=0x70036, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.786] SetParent (hWndChild=0x70036, hWndNewParent=0x202cc) returned 0x601e2 [0091.786] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.786] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.788] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.788] GetClientRect (in: hWnd=0x70036, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.788] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.788] GetParent (hWnd=0x70036) returned 0x601e2 [0091.788] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned 2097184000 [0091.788] GetParent (hWnd=0x70036) returned 0x601e2 [0091.789] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.791] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.791] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.791] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe87000c) returned 0x0 [0091.791] GetClientRect (in: hWnd=0x70036, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.791] GetWindowRect (in: hWnd=0x70036, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.791] GetParent (hWnd=0x70036) returned 0x202cc [0091.791] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd64, cPoints=0x2 | out: lpPoints=0x55dd64) returned -1966088 [0091.791] GetClientRect (in: hWnd=0x70036, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.791] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.791] GetParent (hWnd=0x70036) returned 0x202cc [0091.791] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned -1966088 [0091.791] GetParent (hWnd=0x70036) returned 0x202cc [0091.792] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.792] GetWindowThreadProcessId (in: hWnd=0x70030, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.792] SetParent (hWndChild=0x70030, hWndNewParent=0x202cc) returned 0x601e2 [0091.792] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.792] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.794] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.794] GetClientRect (in: hWnd=0x70030, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.794] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.794] GetParent (hWnd=0x70030) returned 0x601e2 [0091.794] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e4a8, cPoints=0x2 | out: lpPoints=0x55e4a8) returned 2097184000 [0091.794] GetParent (hWnd=0x70030) returned 0x601e2 [0091.795] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.796] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.796] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.796] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff83feb5) returned 0x0 [0091.796] GetClientRect (in: hWnd=0x70030, lpRect=0x55dd78 | out: lpRect=0x55dd78) returned 1 [0091.796] GetWindowRect (in: hWnd=0x70030, lpRect=0x55dd78 | out: lpRect=0x55dd78) returned 1 [0091.796] GetParent (hWnd=0x70030) returned 0x202cc [0091.796] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd78, cPoints=0x2 | out: lpPoints=0x55dd78) returned -1966088 [0091.796] GetClientRect (in: hWnd=0x70030, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.796] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.796] GetParent (hWnd=0x70030) returned 0x202cc [0091.797] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e4a8, cPoints=0x2 | out: lpPoints=0x55e4a8) returned -1966088 [0091.797] GetParent (hWnd=0x70030) returned 0x202cc [0091.797] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.797] GetWindowThreadProcessId (in: hWnd=0x502b6, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.797] SetParent (hWndChild=0x502b6, hWndNewParent=0x202cc) returned 0x601e2 [0091.797] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.797] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.799] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.799] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.799] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.799] GetParent (hWnd=0x502b6) returned 0x601e2 [0091.799] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e4a8, cPoints=0x2 | out: lpPoints=0x55e4a8) returned 2097184000 [0091.799] GetParent (hWnd=0x502b6) returned 0x601e2 [0091.800] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.801] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.801] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.801] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0091.801] GetClientRect (in: hWnd=0x502b6, lpRect=0x55dd78 | out: lpRect=0x55dd78) returned 1 [0091.801] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55dd78 | out: lpRect=0x55dd78) returned 1 [0091.801] GetParent (hWnd=0x502b6) returned 0x202cc [0091.801] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd78, cPoints=0x2 | out: lpPoints=0x55dd78) returned -1966088 [0091.801] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.801] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e4a8 | out: lpRect=0x55e4a8) returned 1 [0091.802] GetParent (hWnd=0x502b6) returned 0x202cc [0091.802] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e4a8, cPoints=0x2 | out: lpPoints=0x55e4a8) returned -1966088 [0091.802] GetParent (hWnd=0x502b6) returned 0x202cc [0091.802] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.802] GetWindowThreadProcessId (in: hWnd=0x18001c, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.802] SetParent (hWndChild=0x18001c, hWndNewParent=0x202cc) returned 0x601e2 [0091.802] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.802] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.804] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.804] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.804] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.804] GetParent (hWnd=0x18001c) returned 0x601e2 [0091.804] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned 2097184000 [0091.804] GetParent (hWnd=0x18001c) returned 0x601e2 [0091.805] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.806] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.807] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.807] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xff47000c) returned 0x0 [0091.807] GetClientRect (in: hWnd=0x18001c, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.807] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.807] GetParent (hWnd=0x18001c) returned 0x202cc [0091.807] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd64, cPoints=0x2 | out: lpPoints=0x55dd64) returned -1966088 [0091.807] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.807] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.807] GetParent (hWnd=0x18001c) returned 0x202cc [0091.807] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned -1966088 [0091.807] GetParent (hWnd=0x18001c) returned 0x202cc [0091.807] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.807] GetWindowThreadProcessId (in: hWnd=0x202c8, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.807] SetParent (hWndChild=0x202c8, hWndNewParent=0x202cc) returned 0x601e2 [0091.807] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.808] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.809] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.809] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.809] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.809] GetParent (hWnd=0x202c8) returned 0x601e2 [0091.809] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned 2097184000 [0091.809] GetParent (hWnd=0x202c8) returned 0x601e2 [0091.810] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.815] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.816] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.816] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x3, wParam=0x0, lParam=0xfede000c) returned 0x0 [0091.816] GetClientRect (in: hWnd=0x202c8, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.816] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.816] GetParent (hWnd=0x202c8) returned 0x202cc [0091.816] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd64, cPoints=0x2 | out: lpPoints=0x55dd64) returned -1966088 [0091.816] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.816] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.816] GetParent (hWnd=0x202c8) returned 0x202cc [0091.816] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned -1966088 [0091.816] GetParent (hWnd=0x202c8) returned 0x202cc [0091.816] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x202c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.816] GetWindowThreadProcessId (in: hWnd=0x300ec, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.816] SetParent (hWndChild=0x300ec, hWndNewParent=0x202cc) returned 0x601e2 [0091.817] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.817] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.818] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.818] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.818] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.818] GetParent (hWnd=0x300ec) returned 0x601e2 [0091.818] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned 2097184000 [0091.818] GetParent (hWnd=0x300ec) returned 0x601e2 [0091.819] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.820] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.821] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.821] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x3, wParam=0x0, lParam=0xfe50000c) returned 0x0 [0091.822] GetClientRect (in: hWnd=0x300ec, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.822] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55dd64 | out: lpRect=0x55dd64) returned 1 [0091.822] GetParent (hWnd=0x300ec) returned 0x202cc [0091.822] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55dd64, cPoints=0x2 | out: lpPoints=0x55dd64) returned -1966088 [0091.822] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.822] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e494 | out: lpRect=0x55e494) returned 1 [0091.822] GetParent (hWnd=0x300ec) returned 0x202cc [0091.822] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e494, cPoints=0x2 | out: lpPoints=0x55e494) returned -1966088 [0091.822] GetParent (hWnd=0x300ec) returned 0x202cc [0091.822] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x300ec, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.823] GetWindowThreadProcessId (in: hWnd=0x502c2, lpdwProcessId=0x55e874 | out: lpdwProcessId=0x55e874) returned 0x112c [0091.823] SetParent (hWndChild=0x502c2, hWndNewParent=0x202cc) returned 0x601e2 [0091.823] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0091.823] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.824] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.825] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e4d0 | out: lpRect=0x55e4d0) returned 1 [0091.825] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e4d0 | out: lpRect=0x55e4d0) returned 1 [0091.825] GetParent (hWnd=0x502c2) returned 0x601e2 [0091.825] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601e2, lpPoints=0x55e4d0, cPoints=0x2 | out: lpPoints=0x55e4d0) returned 2097184000 [0091.825] GetParent (hWnd=0x502c2) returned 0x601e2 [0091.825] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x46, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.827] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0091.827] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x47, wParam=0x0, lParam=0x55e7d4) returned 0x0 [0091.827] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x3, wParam=0x0, lParam=0xc012a) returned 0x0 [0091.827] GetClientRect (in: hWnd=0x502c2, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0091.827] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0091.827] GetParent (hWnd=0x502c2) returned 0x202cc [0091.827] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55de78, cPoints=0x2 | out: lpPoints=0x55de78) returned -1966088 [0091.827] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e4d0 | out: lpRect=0x55e4d0) returned 1 [0091.827] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e4d0 | out: lpRect=0x55e4d0) returned 1 [0091.827] GetParent (hWnd=0x502c2) returned 0x202cc [0091.827] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x202cc, lpPoints=0x55e4d0, cPoints=0x2 | out: lpPoints=0x55e4d0) returned -1966088 [0091.827] GetParent (hWnd=0x502c2) returned 0x202cc [0091.827] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0091.828] GetWindowLongW (hWnd=0x601e2, nIndex=-20) returned 852352 [0091.828] DestroyWindow (hWnd=0x601e2) returned 1 [0091.828] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0091.828] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x46, wParam=0x0, lParam=0x55e75c) returned 0x0 [0091.832] GetWindowPlacement (in: hWnd=0x601e2, lpwndpl=0x55e488 | out: lpwndpl=0x55e488) returned 1 [0091.832] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x47, wParam=0x0, lParam=0x55e75c) returned 0x0 [0091.833] GetClientRect (in: hWnd=0x601e2, lpRect=0x55e438 | out: lpRect=0x55e438) returned 1 [0091.833] GetWindowRect (in: hWnd=0x601e2, lpRect=0x55e438 | out: lpRect=0x55e438) returned 1 [0091.833] GetWindowTextLengthW (hWnd=0x601e2) returned 3 [0091.833] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0091.833] GetSystemMetrics (nIndex=42) returned 0 [0091.833] GetWindowTextW (in: hWnd=0x601e2, lpString=0x55e36c, nMaxCount=4 | out: lpString="Lol") returned 3 [0091.833] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0xd, wParam=0x4, lParam=0x55e36c) returned 0x3 [0091.833] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0091.834] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x601e2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0091.839] GetCurrentActCtx (in: lphActCtx=0x55e7bc | out: lphActCtx=0x55e7bc*=0x769b1c) returned 1 [0091.840] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0091.840] AdjustWindowRectEx (in: lpRect=0x55e71c, dwStyle=0x12cf0000, bMenu=0, dwExStyle=0x90080 | out: lpRect=0x55e71c) returned 1 [0091.840] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0091.840] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Lol", dwStyle=0x22cf0000, X=-32000, Y=-32000, nWidth=16, nHeight=39, hWndParent=0x0, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x701e2 [0091.841] SetWindowLongW (hWnd=0x701e2, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0091.841] GetWindowLongW (hWnd=0x701e2, nIndex=-4) returned 1950089536 [0091.841] SetWindowLongW (hWnd=0x701e2, nIndex=-4, dwNewLong=77478790) returned 1950089536 [0091.842] GetWindowLongW (hWnd=0x701e2, nIndex=-4) returned 77478790 [0091.842] GetWindowLongW (hWnd=0x701e2, nIndex=-16) returned 651100160 [0091.843] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x81, wParam=0x0, lParam=0x55e1e0) returned 0x1 [0091.844] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x83, wParam=0x0, lParam=0x55e1cc) returned 0x0 [0091.845] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x1, wParam=0x0, lParam=0x55e1e0) returned 0x0 [0091.845] GetClientRect (in: hWnd=0x701e2, lpRect=0x55de98 | out: lpRect=0x55de98) returned 1 [0091.845] GetWindowRect (in: hWnd=0x701e2, lpRect=0x55de98 | out: lpRect=0x55de98) returned 1 [0091.845] SetWindowTextW (hWnd=0x701e2, lpString="Lol") returned 1 [0091.845] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xc, wParam=0x0, lParam=0x2397428) returned 0x1 [0091.846] SetLayeredWindowAttributes (hwnd=0x701e2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0091.848] GetStartupInfoW (in: lpStartupInfo=0x2397704 | out: lpStartupInfo=0x2397704*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0091.849] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x46, wParam=0x0, lParam=0x55e1f4) returned 0x0 [0091.850] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x83, wParam=0x1, lParam=0x55e1cc) returned 0x0 [0091.857] GetWindowPlacement (in: hWnd=0x701e2, lpwndpl=0x55df20 | out: lpwndpl=0x55df20) returned 1 [0091.857] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x47, wParam=0x0, lParam=0x55e1f4) returned 0x0 [0091.857] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x3, wParam=0x0, lParam=0x3400000) returned 0x0 [0091.857] GetClientRect (in: hWnd=0x701e2, lpRect=0x55d820 | out: lpRect=0x55d820) returned 1 [0091.857] GetWindowRect (in: hWnd=0x701e2, lpRect=0x55d820 | out: lpRect=0x55d820) returned 1 [0091.857] GetWindowTextLengthW (hWnd=0x701e2) returned 3 [0091.858] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0091.858] GetSystemMetrics (nIndex=42) returned 0 [0091.858] GetWindowTextW (in: hWnd=0x701e2, lpString=0x55d694, nMaxCount=4 | out: lpString="Lol") returned 3 [0091.858] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xd, wParam=0x4, lParam=0x55d694) returned 0x3 [0091.858] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0091.858] GetClientRect (in: hWnd=0x701e2, lpRect=0x55ded0 | out: lpRect=0x55ded0) returned 1 [0091.858] GetWindowRect (in: hWnd=0x701e2, lpRect=0x55ded0 | out: lpRect=0x55ded0) returned 1 [0091.860] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x83, wParam=0x1, lParam=0x55dd0c) returned 0x0 [0091.863] GetParent (hWnd=0x701e2) returned 0x0 [0091.863] GetStockObject (i=5) returned 0x900015 [0091.864] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0091.864] CoTaskMemAlloc (cb=0x5a) returned 0x7720e0 [0091.864] RegisterClassW (lpWndClass=0x55e698) returned 0xc1a1 [0091.865] CoTaskMemFree (pv=0x7720e0) [0091.865] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0091.865] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x502c4 [0091.866] SetWindowLongW (hWnd=0x502c4, nIndex=-4, dwNewLong=1950089536) returned 77479230 [0091.866] GetWindowLongW (hWnd=0x502c4, nIndex=-4) returned 1950089536 [0091.866] SetWindowLongW (hWnd=0x502c4, nIndex=-4, dwNewLong=77478550) returned 1950089536 [0091.866] GetWindowLongW (hWnd=0x502c4, nIndex=-4) returned 77478550 [0091.866] GetWindowLongW (hWnd=0x502c4, nIndex=-16) returned 79691776 [0091.866] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c4, Msg=0x24, wParam=0x0, lParam=0x55e214) returned 0x0 [0091.866] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c4, Msg=0x81, wParam=0x0, lParam=0x55e208) returned 0x1 [0091.867] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c4, Msg=0x83, wParam=0x0, lParam=0x55e1f4) returned 0x0 [0091.869] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c4, Msg=0x1, wParam=0x0, lParam=0x55e208) returned 0x0 [0091.870] SetWindowLongW (hWnd=0x701e2, nIndex=-8, dwNewLong=328388) returned 0 [0091.872] SendMessageW (hWnd=0x701e2, Msg=0x80, wParam=0x0, lParam=0xe0213) returned 0x0 [0091.872] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x80, wParam=0x0, lParam=0xe0213) returned 0x0 [0091.872] SendMessageW (hWnd=0x701e2, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0091.872] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0092.033] GetSystemMenu (hWnd=0x701e2, bRevert=0) returned 0x701ed [0092.034] GetWindowPlacement (in: hWnd=0x701e2, lpwndpl=0x55e7cc | out: lpwndpl=0x55e7cc) returned 1 [0092.034] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0092.034] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0092.034] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0092.034] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0092.034] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0092.034] SetWindowPos (hWnd=0x701e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0092.034] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x46, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.038] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0092.043] GetWindowPlacement (in: hWnd=0x701e2, lpwndpl=0x55e408 | out: lpwndpl=0x55e408) returned 1 [0092.043] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x47, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.043] GetClientRect (in: hWnd=0x701e2, lpRect=0x55e3b8 | out: lpRect=0x55e3b8) returned 1 [0092.043] GetWindowRect (in: hWnd=0x701e2, lpRect=0x55e3b8 | out: lpRect=0x55e3b8) returned 1 [0092.044] SetWindowLongW (hWnd=0x701e2, nIndex=-8, dwNewLong=328388) returned 328388 [0092.045] SendMessageW (hWnd=0x502c4, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0092.046] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502c4, Msg=0x80, wParam=0x1, lParam=0x402ad) returned 0x0 [0092.048] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.048] GetWindowLongW (hWnd=0x701e2, nIndex=-16) returned 919535616 [0092.048] GetWindowTextLengthW (hWnd=0x701e2) returned 3 [0092.048] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0092.048] GetSystemMetrics (nIndex=42) returned 0 [0092.048] GetWindowTextW (in: hWnd=0x701e2, lpString=0x55e718, nMaxCount=4 | out: lpString="Lol") returned 3 [0092.048] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xd, wParam=0x4, lParam=0x55e718) returned 0x3 [0092.049] GetWindowTextLengthW (hWnd=0x701e2) returned 3 [0092.049] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x3 [0092.049] GetSystemMetrics (nIndex=42) returned 0 [0092.049] GetWindowTextW (in: hWnd=0x701e2, lpString=0x55e718, nMaxCount=4 | out: lpString="Lol") returned 3 [0092.049] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0xd, wParam=0x4, lParam=0x55e718) returned 0x3 [0092.050] AdjustWindowRectEx (in: lpRect=0x55e75c, dwStyle=0x12cf0000, bMenu=0, dwExStyle=0x90080 | out: lpRect=0x55e75c) returned 1 [0092.050] GetWindowLongW (hWnd=0x701e2, nIndex=-16) returned 919535616 [0092.050] GetWindowLongW (hWnd=0x701e2, nIndex=-20) returned 590208 [0092.050] SetWindowLongW (hWnd=0x701e2, nIndex=-16, dwNewLong=852426752) returned 919535616 [0092.050] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x7c, wParam=0xfffffff0, lParam=0x55e76c) returned 0x0 [0092.050] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x7d, wParam=0xfffffff0, lParam=0x55e76c) returned 0x0 [0092.051] SetWindowLongW (hWnd=0x701e2, nIndex=-20, dwNewLong=589952) returned 590208 [0092.051] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x7c, wParam=0xffffffec, lParam=0x55e76c) returned 0x0 [0092.052] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x7d, wParam=0xffffffec, lParam=0x55e76c) returned 0x0 [0092.052] SetWindowPos (hWnd=0x701e2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0092.052] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x46, wParam=0x0, lParam=0x55e784) returned 0x0 [0092.053] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x83, wParam=0x1, lParam=0x55e75c) returned 0x0 [0092.054] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0092.056] GetWindowPlacement (in: hWnd=0x701e2, lpwndpl=0x55e4b0 | out: lpwndpl=0x55e4b0) returned 1 [0092.056] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x47, wParam=0x0, lParam=0x55e784) returned 0x0 [0092.056] GetClientRect (in: hWnd=0x701e2, lpRect=0x55e460 | out: lpRect=0x55e460) returned 1 [0092.057] GetWindowRect (in: hWnd=0x701e2, lpRect=0x55e460 | out: lpRect=0x55e460) returned 1 [0092.057] RedrawWindow (hWnd=0x701e2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0092.057] GetSystemMenu (hWnd=0x701e2, bRevert=0) returned 0x701ed [0092.057] GetWindowPlacement (in: hWnd=0x701e2, lpwndpl=0x55e7bc | out: lpwndpl=0x55e7bc) returned 1 [0092.058] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0092.058] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0092.058] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0092.058] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf120, uEnable=0x0) returned 0 [0092.058] EnableMenuItem (hMenu=0x701ed, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0092.058] SetParent (hWndChild=0x7002e, hWndNewParent=0x701e2) returned 0x202cc [0092.058] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.059] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.060] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.060] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.060] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0xffb0000c) returned 0x0 [0092.061] GetClientRect (in: hWnd=0x7002e, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.061] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.061] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.061] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd7c, cPoints=0x2 | out: lpPoints=0x55dd7c) returned -54525952 [0092.061] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.061] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.061] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.061] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.061] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.061] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.061] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.063] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.063] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.063] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.063] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.063] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.063] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.063] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x0 [0092.063] GetFocus () returned 0x0 [0092.063] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.063] GetWindowLongW (hWnd=0x7002e, nIndex=-20) returned 0 [0092.063] DestroyWindow (hWnd=0x7002e) returned 1 [0092.063] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0092.064] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x210, wParam=0x2e0002, lParam=0x7002e) returned 0x0 [0092.064] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.064] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.065] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.065] GetClientRect (in: hWnd=0x7002e, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.066] GetWindowRect (in: hWnd=0x7002e, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.066] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.066] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e39c, cPoints=0x2 | out: lpPoints=0x55e39c) returned -54525952 [0092.066] GetParent (hWnd=0x7002e) returned 0x701e2 [0092.066] GetWindowTextLengthW (hWnd=0x7002e) returned 1 [0092.066] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1 [0092.066] GetSystemMetrics (nIndex=42) returned 0 [0092.066] GetWindowTextW (in: hWnd=0x7002e, lpString=0x55e2e0, nMaxCount=2 | out: lpString=".") returned 1 [0092.066] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0xd, wParam=0x2, lParam=0x55e2e0) returned 0x1 [0092.066] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0092.066] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0092.068] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.068] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.069] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.069] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName=".", dwStyle=0x5600000d, X=12, Y=-80, nWidth=0, nHeight=71, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x8002e [0092.069] SetWindowLongW (hWnd=0x8002e, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0092.069] GetWindowLongW (hWnd=0x8002e, nIndex=-4) returned 1874504640 [0092.070] SetWindowLongW (hWnd=0x8002e, nIndex=-4, dwNewLong=77478590) returned 1874504640 [0092.070] GetWindowLongW (hWnd=0x8002e, nIndex=-4) returned 77478590 [0092.070] GetWindowLongW (hWnd=0x8002e, nIndex=-16) returned 1174405133 [0092.070] GetWindowLongW (hWnd=0x8002e, nIndex=-12) returned 0 [0092.070] SetWindowLongW (hWnd=0x8002e, nIndex=-12, dwNewLong=524334) returned 0 [0092.070] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x81, wParam=0x0, lParam=0x55e1b0) returned 0x1 [0092.076] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x83, wParam=0x0, lParam=0x55e19c) returned 0x0 [0092.077] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x1, wParam=0x0, lParam=0x55e1b0) returned 0x0 [0092.078] GetWindow (hWnd=0x8002e, uCmd=0x3) returned 0x0 [0092.078] GetClientRect (in: hWnd=0x8002e, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.078] GetWindowRect (in: hWnd=0x8002e, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.078] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.078] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de5c, cPoints=0x2 | out: lpPoints=0x55de5c) returned -54525952 [0092.078] SetWindowTextW (hWnd=0x8002e, lpString=".") returned 1 [0092.078] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0xc, wParam=0x0, lParam=0x2397bdc) returned 0x1 [0092.080] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x5, wParam=0x0, lParam=0x470000) returned 0x0 [0092.080] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x3, wParam=0x0, lParam=0xffb0000c) returned 0x0 [0092.080] GetClientRect (in: hWnd=0x8002e, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.080] GetWindowRect (in: hWnd=0x8002e, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.080] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.081] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55deb4, cPoints=0x2 | out: lpPoints=0x55deb4) returned -54525952 [0092.081] SendMessageW (hWnd=0x8002e, Msg=0x2210, wParam=0x2e0001, lParam=0x8002e) returned 0x0 [0092.081] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x2210, wParam=0x2e0001, lParam=0x8002e) returned 0x0 [0092.081] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.081] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x46, wParam=0x0, lParam=0x55e1c4) returned 0x0 [0092.083] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x8002e, Msg=0x47, wParam=0x0, lParam=0x55e1c4) returned 0x0 [0092.084] GetClientRect (in: hWnd=0x8002e, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.084] GetWindowRect (in: hWnd=0x8002e, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.084] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.084] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de84, cPoints=0x2 | out: lpPoints=0x55de84) returned -54525952 [0092.084] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.084] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.084] SetParent (hWndChild=0x70036, hWndNewParent=0x701e2) returned 0x202cc [0092.085] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.085] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.088] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.088] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.088] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x3, wParam=0x0, lParam=0xfe87000c) returned 0x0 [0092.088] GetClientRect (in: hWnd=0x70036, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.088] GetWindowRect (in: hWnd=0x70036, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.088] GetParent (hWnd=0x70036) returned 0x701e2 [0092.088] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd7c, cPoints=0x2 | out: lpPoints=0x55dd7c) returned -54525952 [0092.088] GetClientRect (in: hWnd=0x70036, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.088] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.088] GetParent (hWnd=0x70036) returned 0x701e2 [0092.088] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.089] GetParent (hWnd=0x70036) returned 0x701e2 [0092.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.091] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.091] GetClientRect (in: hWnd=0x70036, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.091] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.091] GetParent (hWnd=0x70036) returned 0x701e2 [0092.092] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.092] GetParent (hWnd=0x70036) returned 0x701e2 [0092.092] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x0 [0092.092] SetWindowPos (hWnd=0x70036, hWndInsertAfter=0x8002e, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.092] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.095] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.095] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.095] GetClientRect (in: hWnd=0x70036, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.095] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.095] GetParent (hWnd=0x70036) returned 0x701e2 [0092.095] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e464, cPoints=0x2 | out: lpPoints=0x55e464) returned -54525952 [0092.095] GetParent (hWnd=0x70036) returned 0x701e2 [0092.095] GetWindow (hWnd=0x70036, uCmd=0x3) returned 0x8002e [0092.096] GetFocus () returned 0x0 [0092.096] GetParent (hWnd=0x70036) returned 0x701e2 [0092.096] GetWindowLongW (hWnd=0x70036, nIndex=-20) returned 0 [0092.096] DestroyWindow (hWnd=0x70036) returned 1 [0092.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0092.096] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x210, wParam=0x360002, lParam=0x70036) returned 0x0 [0092.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.096] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x46, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.099] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x47, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.099] GetClientRect (in: hWnd=0x70036, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.100] GetWindowRect (in: hWnd=0x70036, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.100] GetParent (hWnd=0x70036) returned 0x701e2 [0092.100] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e39c, cPoints=0x2 | out: lpPoints=0x55e39c) returned -54525952 [0092.100] GetParent (hWnd=0x70036) returned 0x701e2 [0092.100] GetWindowTextLengthW (hWnd=0x70036) returned 32 [0092.100] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x20 [0092.100] GetSystemMetrics (nIndex=42) returned 0 [0092.100] GetWindowTextW (in: hWnd=0x70036, lpString=0x55e2a0, nMaxCount=33 | out: lpString="In order to recover your data...") returned 32 [0092.100] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0xd, wParam=0x21, lParam=0x55e2a0) returned 0x20 [0092.100] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0092.101] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x70036, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0092.109] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.109] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.110] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.110] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="In order to recover your data...", dwStyle=0x5600000d, X=12, Y=-377, nWidth=0, nHeight=87, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x80036 [0092.110] SetWindowLongW (hWnd=0x80036, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0092.110] GetWindowLongW (hWnd=0x80036, nIndex=-4) returned 1874504640 [0092.111] SetWindowLongW (hWnd=0x80036, nIndex=-4, dwNewLong=77479350) returned 1874504640 [0092.111] GetWindowLongW (hWnd=0x80036, nIndex=-4) returned 77479350 [0092.111] GetWindowLongW (hWnd=0x80036, nIndex=-16) returned 1174405133 [0092.111] GetWindowLongW (hWnd=0x80036, nIndex=-12) returned 0 [0092.111] SetWindowLongW (hWnd=0x80036, nIndex=-12, dwNewLong=524342) returned 0 [0092.111] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x81, wParam=0x0, lParam=0x55e1b0) returned 0x1 [0092.112] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x83, wParam=0x0, lParam=0x55e19c) returned 0x0 [0092.112] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x1, wParam=0x0, lParam=0x55e1b0) returned 0x0 [0092.112] GetWindow (hWnd=0x80036, uCmd=0x3) returned 0x8002e [0092.112] GetClientRect (in: hWnd=0x80036, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.112] GetWindowRect (in: hWnd=0x80036, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.112] GetParent (hWnd=0x80036) returned 0x701e2 [0092.113] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de5c, cPoints=0x2 | out: lpPoints=0x55de5c) returned -54525952 [0092.113] SetWindowTextW (hWnd=0x80036, lpString="In order to recover your data...") returned 1 [0092.113] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0xc, wParam=0x0, lParam=0x2397f34) returned 0x1 [0092.113] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x5, wParam=0x0, lParam=0x570000) returned 0x0 [0092.114] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x3, wParam=0x0, lParam=0xfe87000c) returned 0x0 [0092.114] GetClientRect (in: hWnd=0x80036, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.114] GetWindowRect (in: hWnd=0x80036, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.114] GetParent (hWnd=0x80036) returned 0x701e2 [0092.114] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55deb4, cPoints=0x2 | out: lpPoints=0x55deb4) returned -54525952 [0092.114] SendMessageW (hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0092.114] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x2210, wParam=0x360001, lParam=0x80036) returned 0x0 [0092.114] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.114] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x46, wParam=0x0, lParam=0x55e1c4) returned 0x0 [0092.115] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x80036, Msg=0x47, wParam=0x0, lParam=0x55e1c4) returned 0x0 [0092.116] GetClientRect (in: hWnd=0x80036, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.116] GetWindowRect (in: hWnd=0x80036, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.116] GetParent (hWnd=0x80036) returned 0x701e2 [0092.116] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de84, cPoints=0x2 | out: lpPoints=0x55de84) returned -54525952 [0092.116] GetParent (hWnd=0x80036) returned 0x701e2 [0092.116] GetParent (hWnd=0x80036) returned 0x701e2 [0092.116] SetParent (hWndChild=0x70030, hWndNewParent=0x701e2) returned 0x202cc [0092.116] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.117] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.118] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.118] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.118] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0xff83feb5) returned 0x0 [0092.118] GetClientRect (in: hWnd=0x70030, lpRect=0x55dd90 | out: lpRect=0x55dd90) returned 1 [0092.118] GetWindowRect (in: hWnd=0x70030, lpRect=0x55dd90 | out: lpRect=0x55dd90) returned 1 [0092.118] GetParent (hWnd=0x70030) returned 0x701e2 [0092.118] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd90, cPoints=0x2 | out: lpPoints=0x55dd90) returned -54525952 [0092.118] GetClientRect (in: hWnd=0x70030, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.118] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.118] GetParent (hWnd=0x70030) returned 0x701e2 [0092.118] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4c0, cPoints=0x2 | out: lpPoints=0x55e4c0) returned -54525952 [0092.118] GetParent (hWnd=0x70030) returned 0x701e2 [0092.118] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.119] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.120] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.120] GetClientRect (in: hWnd=0x70030, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.120] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.120] GetParent (hWnd=0x70030) returned 0x701e2 [0092.120] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4c0, cPoints=0x2 | out: lpPoints=0x55e4c0) returned -54525952 [0092.120] GetParent (hWnd=0x70030) returned 0x701e2 [0092.120] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x0 [0092.120] SetWindowPos (hWnd=0x70030, hWndInsertAfter=0x80036, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.120] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.122] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.122] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.122] GetClientRect (in: hWnd=0x70030, lpRect=0x55e478 | out: lpRect=0x55e478) returned 1 [0092.122] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e478 | out: lpRect=0x55e478) returned 1 [0092.122] GetParent (hWnd=0x70030) returned 0x701e2 [0092.122] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e478, cPoints=0x2 | out: lpPoints=0x55e478) returned -54525952 [0092.122] GetParent (hWnd=0x70030) returned 0x701e2 [0092.122] GetWindow (hWnd=0x70030, uCmd=0x3) returned 0x80036 [0092.122] GetFocus () returned 0x0 [0092.122] GetParent (hWnd=0x70030) returned 0x701e2 [0092.122] GetWindowLongW (hWnd=0x70030, nIndex=-20) returned 512 [0092.122] DestroyWindow (hWnd=0x70030) returned 1 [0092.122] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0092.122] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x210, wParam=0x300002, lParam=0x70030) returned 0x0 [0092.123] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.123] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.125] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.125] GetClientRect (in: hWnd=0x70030, lpRect=0x55e3b0 | out: lpRect=0x55e3b0) returned 1 [0092.125] GetWindowRect (in: hWnd=0x70030, lpRect=0x55e3b0 | out: lpRect=0x55e3b0) returned 1 [0092.125] GetParent (hWnd=0x70030) returned 0x701e2 [0092.125] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e3b0, cPoints=0x2 | out: lpPoints=0x55e3b0) returned -54525952 [0092.125] GetParent (hWnd=0x70030) returned 0x701e2 [0092.125] SendMessageW (hWnd=0x70030, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0092.125] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0092.126] SendMessageW (hWnd=0x70030, Msg=0xb0, wParam=0x2378a84, lParam=0x55e3b0) returned 0x0 [0092.126] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xb0, wParam=0x2378a84, lParam=0x55e3b0) returned 0x0 [0092.126] GetWindowTextLengthW (hWnd=0x70030) returned 33 [0092.126] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.126] GetSystemMetrics (nIndex=42) returned 0 [0092.126] GetWindowTextW (in: hWnd=0x70030, lpString=0x55e290, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0092.126] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0xd, wParam=0x22, lParam=0x55e290) returned 0x21 [0092.126] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0092.127] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x70030, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0092.128] GetCurrentActCtx (in: lphActCtx=0x55e76c | out: lphActCtx=0x55e76c*=0x769b1c) returned 1 [0092.129] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.129] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.129] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="friendly.cyber.criminal@gmail.com", dwStyle=0x560108c1, X=-333, Y=-127, nWidth=677, nHeight=44, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x80030 [0092.129] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=1874383968) returned 77466110 [0092.130] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 1874383968 [0092.130] SetWindowLongW (hWnd=0x80030, nIndex=-4, dwNewLong=77479270) returned 1874383968 [0092.130] GetWindowLongW (hWnd=0x80030, nIndex=-4) returned 77479270 [0092.130] GetWindowLongW (hWnd=0x80030, nIndex=-16) returned 1174472897 [0092.130] GetWindowLongW (hWnd=0x80030, nIndex=-12) returned 0 [0092.130] SetWindowLongW (hWnd=0x80030, nIndex=-12, dwNewLong=524336) returned 0 [0092.130] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x81, wParam=0x0, lParam=0x55e190) returned 0x1 [0092.131] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x83, wParam=0x0, lParam=0x55e17c) returned 0x0 [0092.131] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x1, wParam=0x0, lParam=0x55e190) returned 0x1 [0092.132] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x4000030, lParam=0x80030) returned 0x0 [0092.132] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x3000030, lParam=0x80030) returned 0x0 [0092.133] SendMessageW (hWnd=0x80030, Msg=0x2055, wParam=0x80030, lParam=0x3) returned 0x2 [0092.133] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0092.133] GetWindow (hWnd=0x80030, uCmd=0x3) returned 0x80036 [0092.133] GetClientRect (in: hWnd=0x80030, lpRect=0x55de50 | out: lpRect=0x55de50) returned 1 [0092.133] GetWindowRect (in: hWnd=0x80030, lpRect=0x55de50 | out: lpRect=0x55de50) returned 1 [0092.133] GetParent (hWnd=0x80030) returned 0x701e2 [0092.133] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de50, cPoints=0x2 | out: lpPoints=0x55de50) returned -54525952 [0092.133] SendMessageW (hWnd=0x80030, Msg=0x30, wParam=0xf0a07e9, lParam=0x0) returned 0x1 [0092.133] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x30, wParam=0xf0a07e9, lParam=0x0) returned 0x1 [0092.133] SendMessageW (hWnd=0x80030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0092.133] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0092.133] SetWindowTextW (hWnd=0x80030, lpString="friendly.cyber.criminal@gmail.com") returned 1 [0092.133] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xc, wParam=0x0, lParam=0x23982cc) returned 0x1 [0092.134] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x4000030, lParam=0x80030) returned 0x0 [0092.134] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x3000030, lParam=0x80030) returned 0x0 [0092.134] GetSystemMetrics (nIndex=5) returned 1 [0092.134] GetSystemMetrics (nIndex=6) returned 1 [0092.134] SendMessageW (hWnd=0x80030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0092.134] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0092.134] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0092.134] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.134] SendMessageW (hWnd=0x80030, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0092.134] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xb1, wParam=0x0, lParam=0x0) returned 0x1 [0092.519] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x5, wParam=0x0, lParam=0x2802a1) returned 0x0 [0092.519] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x3, wParam=0x0, lParam=0xff83feb5) returned 0x0 [0092.519] GetClientRect (in: hWnd=0x80030, lpRect=0x55dea8 | out: lpRect=0x55dea8) returned 1 [0092.519] GetWindowRect (in: hWnd=0x80030, lpRect=0x55dea8 | out: lpRect=0x55dea8) returned 1 [0092.519] GetParent (hWnd=0x80030) returned 0x701e2 [0092.519] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dea8, cPoints=0x2 | out: lpPoints=0x55dea8) returned -54525952 [0092.519] SendMessageW (hWnd=0x80030, Msg=0x2210, wParam=0x300001, lParam=0x80030) returned 0x0 [0092.519] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x2210, wParam=0x300001, lParam=0x80030) returned 0x0 [0092.519] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.519] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x46, wParam=0x0, lParam=0x55e1a4) returned 0x0 [0092.521] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0x47, wParam=0x0, lParam=0x55e1a4) returned 0x0 [0092.521] GetClientRect (in: hWnd=0x80030, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0092.521] GetWindowRect (in: hWnd=0x80030, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0092.521] GetParent (hWnd=0x80030) returned 0x701e2 [0092.521] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de78, cPoints=0x2 | out: lpPoints=0x55de78) returned -54525952 [0092.521] GetParent (hWnd=0x80030) returned 0x701e2 [0092.521] GetParent (hWnd=0x80030) returned 0x701e2 [0092.521] SetParent (hWndChild=0x502b6, hWndNewParent=0x701e2) returned 0x202cc [0092.521] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.522] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.523] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.523] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.523] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0092.523] GetClientRect (in: hWnd=0x502b6, lpRect=0x55dd90 | out: lpRect=0x55dd90) returned 1 [0092.523] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55dd90 | out: lpRect=0x55dd90) returned 1 [0092.523] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.523] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd90, cPoints=0x2 | out: lpPoints=0x55dd90) returned -54525952 [0092.523] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.523] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.523] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.524] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4c0, cPoints=0x2 | out: lpPoints=0x55e4c0) returned -54525952 [0092.524] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.524] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.524] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.525] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.525] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.525] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e4c0 | out: lpRect=0x55e4c0) returned 1 [0092.525] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.525] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4c0, cPoints=0x2 | out: lpPoints=0x55e4c0) returned -54525952 [0092.525] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.526] GetWindow (hWnd=0x502b6, uCmd=0x3) returned 0x0 [0092.526] SetWindowPos (hWnd=0x502b6, hWndInsertAfter=0x80030, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.526] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.527] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.527] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e7a4) returned 0x0 [0092.527] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e478 | out: lpRect=0x55e478) returned 1 [0092.527] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e478 | out: lpRect=0x55e478) returned 1 [0092.527] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.527] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e478, cPoints=0x2 | out: lpPoints=0x55e478) returned -54525952 [0092.527] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.527] GetWindow (hWnd=0x502b6, uCmd=0x3) returned 0x80030 [0092.527] GetFocus () returned 0x0 [0092.527] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.528] GetWindowLongW (hWnd=0x502b6, nIndex=-20) returned 512 [0092.528] DestroyWindow (hWnd=0x502b6) returned 1 [0092.528] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0092.528] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x210, wParam=0x2b60002, lParam=0x502b6) returned 0x0 [0092.528] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.528] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x46, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.529] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x47, wParam=0x0, lParam=0x55e6dc) returned 0x0 [0092.529] GetClientRect (in: hWnd=0x502b6, lpRect=0x55e3b0 | out: lpRect=0x55e3b0) returned 1 [0092.529] GetWindowRect (in: hWnd=0x502b6, lpRect=0x55e3b0 | out: lpRect=0x55e3b0) returned 1 [0092.529] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.529] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e3b0, cPoints=0x2 | out: lpPoints=0x55e3b0) returned -54525952 [0092.529] GetParent (hWnd=0x502b6) returned 0x701e2 [0092.530] SendMessageW (hWnd=0x502b6, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0092.530] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0092.530] SendMessageW (hWnd=0x502b6, Msg=0xb0, wParam=0x237811c, lParam=0x55e3b0) returned 0x0 [0092.530] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xb0, wParam=0x237811c, lParam=0x55e3b0) returned 0x0 [0092.530] GetWindowTextLengthW (hWnd=0x502b6) returned 34 [0092.530] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x22 [0092.530] GetSystemMetrics (nIndex=42) returned 0 [0092.530] GetWindowTextW (in: hWnd=0x502b6, lpString=0x55e28c, nMaxCount=35 | out: lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") returned 34 [0092.530] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0xd, wParam=0x23, lParam=0x55e28c) returned 0x22 [0092.530] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0092.531] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x502b6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0092.533] GetCurrentActCtx (in: lphActCtx=0x55e76c | out: lphActCtx=0x55e76c*=0x769b1c) returned 1 [0092.533] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.533] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.534] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r9_ad1", lpWindowName="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1", dwStyle=0x560108c1, X=-333, Y=-232, nWidth=677, nHeight=44, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x602b6 [0092.535] SetWindowLongW (hWnd=0x602b6, nIndex=-4, dwNewLong=1874383968) returned 77466110 [0092.535] GetWindowLongW (hWnd=0x602b6, nIndex=-4) returned 1874383968 [0092.536] SetWindowLongW (hWnd=0x602b6, nIndex=-4, dwNewLong=77478630) returned 1874383968 [0092.536] GetWindowLongW (hWnd=0x602b6, nIndex=-4) returned 77478630 [0092.536] GetWindowLongW (hWnd=0x602b6, nIndex=-16) returned 1174472897 [0092.536] GetWindowLongW (hWnd=0x602b6, nIndex=-12) returned 0 [0092.536] SetWindowLongW (hWnd=0x602b6, nIndex=-12, dwNewLong=393910) returned 0 [0092.536] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x81, wParam=0x0, lParam=0x55e190) returned 0x1 [0092.537] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x83, wParam=0x0, lParam=0x55e17c) returned 0x0 [0092.538] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x1, wParam=0x0, lParam=0x55e190) [0092.538] SendMessageW (hWnd=0x602b6, Msg=0x2111, wParam=0x40002b6, lParam=0x602b6) returned 0x0 [0092.538] SendMessageW (hWnd=0x602b6, Msg=0x2111, wParam=0x30002b6, lParam=0x602b6) returned 0x0 [0092.539] SendMessageW (hWnd=0x602b6, Msg=0x2055, wParam=0x602b6, lParam=0x3) returned 0x2 [0092.539] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x701e2, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0092.539] GetWindow (hWnd=0x602b6, uCmd=0x3) returned 0x80030 [0092.539] GetClientRect (in: hWnd=0x602b6, lpRect=0x55de50 | out: lpRect=0x55de50) returned 1 [0092.539] GetWindowRect (in: hWnd=0x602b6, lpRect=0x55de50 | out: lpRect=0x55de50) returned 1 [0092.539] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.539] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de50, cPoints=0x2 | out: lpPoints=0x55de50) returned -54525952 [0092.539] SendMessageW (hWnd=0x602b6, Msg=0x30, wParam=0x810a07dc, lParam=0x0) [0092.539] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x30, wParam=0x810a07dc, lParam=0x0) returned 0x1 [0092.539] SendMessageW (hWnd=0x602b6, Msg=0xd3, wParam=0x3, lParam=0x0) [0092.539] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0092.540] SetWindowTextW (hWnd=0x602b6, lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") [0092.540] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0xc, wParam=0x0, lParam=0x239866c) [0092.540] SendMessageW (hWnd=0x602b6, Msg=0x2111, wParam=0x40002b6, lParam=0x602b6) [0092.540] GetSystemMetrics (nIndex=5) returned 1 [0092.540] GetSystemMetrics (nIndex=6) returned 1 [0092.540] SendMessageW (hWnd=0x602b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) [0092.540] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0092.544] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x5, wParam=0x0, lParam=0x2802a1) returned 0x0 [0092.544] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x3, wParam=0x0, lParam=0xff1afeb5) returned 0x0 [0092.544] GetClientRect (in: hWnd=0x602b6, lpRect=0x55dea8 | out: lpRect=0x55dea8) returned 1 [0092.544] GetWindowRect (in: hWnd=0x602b6, lpRect=0x55dea8 | out: lpRect=0x55dea8) returned 1 [0092.544] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.544] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dea8, cPoints=0x2 | out: lpPoints=0x55dea8) returned -54525952 [0092.544] SendMessageW (hWnd=0x602b6, Msg=0x2210, wParam=0x2b60001, lParam=0x602b6) [0092.544] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x2210, wParam=0x2b60001, lParam=0x602b6) returned 0x0 [0092.545] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.545] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x46, wParam=0x0, lParam=0x55e1a4) returned 0x0 [0092.548] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0x47, wParam=0x0, lParam=0x55e1a4) returned 0x0 [0092.548] GetClientRect (in: hWnd=0x602b6, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0092.548] GetWindowRect (in: hWnd=0x602b6, lpRect=0x55de78 | out: lpRect=0x55de78) returned 1 [0092.548] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.548] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de78, cPoints=0x2 | out: lpPoints=0x55de78) returned -54525952 [0092.548] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.548] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.548] SetParent (hWndChild=0x18001c, hWndNewParent=0x701e2) [0092.549] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0092.549] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.551] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0092.551] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x55e7ec) [0092.551] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x3, wParam=0x0, lParam=0xff47000c) returned 0x0 [0092.551] GetClientRect (in: hWnd=0x18001c, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.551] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.551] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.551] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd7c, cPoints=0x2 | out: lpPoints=0x55dd7c) returned -54525952 [0092.551] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.551] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.551] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.552] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0092.552] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x46, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.553] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x18001c, Msg=0x47, wParam=0x0, lParam=0x55e7ec) returned 0x0 [0092.553] GetClientRect (in: hWnd=0x18001c, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.553] GetWindowRect (in: hWnd=0x18001c, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.553] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.553] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.553] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.555] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.555] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e464, cPoints=0x2 | out: lpPoints=0x55e464) returned -54525952 [0092.555] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.555] GetWindow (hWnd=0x18001c, uCmd=0x3) returned 0x602b6 [0092.555] GetFocus () returned 0x0 [0092.556] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.556] GetWindowLongW (hWnd=0x18001c, nIndex=-20) returned 0 [0092.556] DestroyWindow (hWnd=0x18001c) [0092.558] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.558] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e39c, cPoints=0x2 | out: lpPoints=0x55e39c) returned -54525952 [0092.558] GetParent (hWnd=0x18001c) returned 0x701e2 [0092.558] GetWindowTextLengthW (hWnd=0x18001c) [0092.560] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.560] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.561] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.561] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Next, E-mail your transaction ID to the following address:", dwStyle=0x5600000d, X=12, Y=-185, nWidth=0, nHeight=55, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x19001c [0092.561] SetWindowLongW (hWnd=0x19001c, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0092.562] GetWindowLongW (hWnd=0x19001c, nIndex=-4) returned 1874504640 [0092.563] SetWindowLongW (hWnd=0x19001c, nIndex=-4, dwNewLong=77478670) returned 1874504640 [0092.563] GetWindowLongW (hWnd=0x19001c, nIndex=-4) returned 77478670 [0092.563] GetWindowLongW (hWnd=0x19001c, nIndex=-16) returned 1174405133 [0092.563] GetWindowLongW (hWnd=0x19001c, nIndex=-12) returned 0 [0092.563] SetWindowLongW (hWnd=0x19001c, nIndex=-12, dwNewLong=1638428) returned 0 [0092.569] GetClientRect (in: hWnd=0x19001c, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.569] GetWindowRect (in: hWnd=0x19001c, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.569] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.569] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de5c, cPoints=0x2 | out: lpPoints=0x55de5c) returned -54525952 [0092.569] SetWindowTextW (hWnd=0x19001c, lpString="Next, E-mail your transaction ID to the following address:") [0092.570] GetClientRect (in: hWnd=0x19001c, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.570] GetWindowRect (in: hWnd=0x19001c, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.570] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.570] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55deb4, cPoints=0x2 | out: lpPoints=0x55deb4) returned -54525952 [0092.570] SendMessageW (hWnd=0x19001c, Msg=0x2210, wParam=0x1c0001, lParam=0x19001c) [0092.573] GetClientRect (in: hWnd=0x19001c, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.573] GetWindowRect (in: hWnd=0x19001c, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.573] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.573] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de84, cPoints=0x2 | out: lpPoints=0x55de84) returned -54525952 [0092.573] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.573] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.573] SetParent (hWndChild=0x202c8, hWndNewParent=0x701e2) returned 0x202cc [0092.579] GetClientRect (in: hWnd=0x202c8, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.579] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.579] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.579] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd7c, cPoints=0x2 | out: lpPoints=0x55dd7c) returned -54525952 [0092.579] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.579] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.579] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.579] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.579] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.581] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.581] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.581] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.581] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.581] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.581] GetWindow (hWnd=0x202c8, uCmd=0x3) returned 0x0 [0092.581] SetWindowPos (hWnd=0x202c8, hWndInsertAfter=0x19001c, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.583] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.583] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.583] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.583] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e464, cPoints=0x2 | out: lpPoints=0x55e464) returned -54525952 [0092.583] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.583] GetWindow (hWnd=0x202c8, uCmd=0x3) returned 0x19001c [0092.583] GetFocus () returned 0x0 [0092.583] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.583] GetWindowLongW (hWnd=0x202c8, nIndex=-20) returned 0 [0092.583] DestroyWindow (hWnd=0x202c8) returned 1 [0092.585] GetClientRect (in: hWnd=0x202c8, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.585] GetWindowRect (in: hWnd=0x202c8, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.585] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.585] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e39c, cPoints=0x2 | out: lpPoints=0x55e39c) returned -54525952 [0092.585] GetParent (hWnd=0x202c8) returned 0x701e2 [0092.585] GetWindowTextLengthW (hWnd=0x202c8) [0092.585] GetWindowTextW (hWnd=0x202c8, lpString=0x55e274, nMaxCount=55) [0092.587] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.587] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.587] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.587] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Please send n Bitcoin(s) to the following BTC address:", dwStyle=0x5600000d, X=12, Y=-290, nWidth=0, nHeight=55, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x302c8 [0092.588] SetWindowLongW (hWnd=0x302c8, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0092.588] GetWindowLongW (hWnd=0x302c8, nIndex=-4) returned 1874504640 [0092.588] SetWindowLongW (hWnd=0x302c8, nIndex=-4, dwNewLong=77478990) returned 1874504640 [0092.588] GetWindowLongW (hWnd=0x302c8, nIndex=-4) returned 77478990 [0092.588] GetWindowLongW (hWnd=0x302c8, nIndex=-16) returned 1174405133 [0092.588] GetWindowLongW (hWnd=0x302c8, nIndex=-12) returned 0 [0092.588] SetWindowLongW (hWnd=0x302c8, nIndex=-12, dwNewLong=197320) returned 0 [0092.589] GetClientRect (in: hWnd=0x302c8, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.589] GetWindowRect (in: hWnd=0x302c8, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.590] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.590] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de5c, cPoints=0x2 | out: lpPoints=0x55de5c) returned -54525952 [0092.590] SetWindowTextW (hWnd=0x302c8, lpString="Please send n Bitcoin(s) to the following BTC address:") [0092.590] GetClientRect (in: hWnd=0x302c8, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.590] GetWindowRect (in: hWnd=0x302c8, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.590] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.590] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55deb4, cPoints=0x2 | out: lpPoints=0x55deb4) returned -54525952 [0092.591] SendMessageW (hWnd=0x302c8, Msg=0x2210, wParam=0x2c80001, lParam=0x302c8) [0092.592] GetClientRect (in: hWnd=0x302c8, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.592] GetWindowRect (in: hWnd=0x302c8, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.592] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.592] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de84, cPoints=0x2 | out: lpPoints=0x55de84) returned -54525952 [0092.592] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.592] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.593] SetParent (hWndChild=0x300ec, hWndNewParent=0x701e2) returned 0x202cc [0092.596] GetClientRect (in: hWnd=0x300ec, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.596] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55dd7c | out: lpRect=0x55dd7c) returned 1 [0092.596] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.596] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dd7c, cPoints=0x2 | out: lpPoints=0x55dd7c) returned -54525952 [0092.596] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.596] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.596] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.596] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.596] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.598] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.598] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e4ac | out: lpRect=0x55e4ac) returned 1 [0092.598] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.598] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4ac, cPoints=0x2 | out: lpPoints=0x55e4ac) returned -54525952 [0092.598] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.598] GetWindow (hWnd=0x300ec, uCmd=0x3) returned 0x0 [0092.598] SetWindowPos (hWnd=0x300ec, hWndInsertAfter=0x302c8, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.599] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.599] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e464 | out: lpRect=0x55e464) returned 1 [0092.600] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.600] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e464, cPoints=0x2 | out: lpPoints=0x55e464) returned -54525952 [0092.600] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.600] GetWindow (hWnd=0x300ec, uCmd=0x3) returned 0x302c8 [0092.600] GetFocus () returned 0x0 [0092.600] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.600] GetWindowLongW (hWnd=0x300ec, nIndex=-20) returned 0 [0092.600] DestroyWindow (hWnd=0x300ec) returned 1 [0092.601] GetClientRect (in: hWnd=0x300ec, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.601] GetWindowRect (in: hWnd=0x300ec, lpRect=0x55e39c | out: lpRect=0x55e39c) returned 1 [0092.601] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.601] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e39c, cPoints=0x2 | out: lpPoints=0x55e39c) returned -54525952 [0092.601] GetParent (hWnd=0x300ec) returned 0x701e2 [0092.602] GetWindowTextLengthW (hWnd=0x300ec) [0092.603] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.603] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.604] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.604] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="Your files (count: n) have been encrypted!", dwStyle=0x5600000d, X=12, Y=-432, nWidth=0, nHeight=55, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x400ec [0092.604] SetWindowLongW (hWnd=0x400ec, nIndex=-4, dwNewLong=1874504640) returned 77465990 [0092.604] GetWindowLongW (hWnd=0x400ec, nIndex=-4) returned 1874504640 [0092.604] SetWindowLongW (hWnd=0x400ec, nIndex=-4, dwNewLong=77479390) returned 1874504640 [0092.605] GetWindowLongW (hWnd=0x400ec, nIndex=-4) returned 77479390 [0092.605] GetWindowLongW (hWnd=0x400ec, nIndex=-16) returned 1174405133 [0092.605] GetWindowLongW (hWnd=0x400ec, nIndex=-12) returned 0 [0092.605] SetWindowLongW (hWnd=0x400ec, nIndex=-12, dwNewLong=262380) returned 0 [0092.606] GetClientRect (in: hWnd=0x400ec, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.606] GetWindowRect (in: hWnd=0x400ec, lpRect=0x55de5c | out: lpRect=0x55de5c) returned 1 [0092.606] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.606] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de5c, cPoints=0x2 | out: lpPoints=0x55de5c) returned -54525952 [0092.606] SetWindowTextW (hWnd=0x400ec, lpString="Your files (count: n) have been encrypted!") [0092.607] GetClientRect (in: hWnd=0x400ec, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.607] GetWindowRect (in: hWnd=0x400ec, lpRect=0x55deb4 | out: lpRect=0x55deb4) returned 1 [0092.607] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.607] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55deb4, cPoints=0x2 | out: lpPoints=0x55deb4) returned -54525952 [0092.607] SendMessageW (hWnd=0x400ec, Msg=0x2210, wParam=0xec0001, lParam=0x400ec) [0092.609] GetClientRect (in: hWnd=0x400ec, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.609] GetWindowRect (in: hWnd=0x400ec, lpRect=0x55de84 | out: lpRect=0x55de84) returned 1 [0092.609] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.609] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de84, cPoints=0x2 | out: lpPoints=0x55de84) returned -54525952 [0092.609] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.609] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.609] SetParent (hWndChild=0x502c2, hWndNewParent=0x701e2) returned 0x202cc [0092.611] GetClientRect (in: hWnd=0x502c2, lpRect=0x55de90 | out: lpRect=0x55de90) returned 1 [0092.611] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55de90 | out: lpRect=0x55de90) returned 1 [0092.612] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.612] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de90, cPoints=0x2 | out: lpPoints=0x55de90) returned -54525952 [0092.612] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e4e8 | out: lpRect=0x55e4e8) returned 1 [0092.612] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e4e8 | out: lpRect=0x55e4e8) returned 1 [0092.612] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.612] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4e8, cPoints=0x2 | out: lpPoints=0x55e4e8) returned -54525952 [0092.612] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.613] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e4e8 | out: lpRect=0x55e4e8) returned 1 [0092.613] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e4e8 | out: lpRect=0x55e4e8) returned 1 [0092.613] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.613] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4e8, cPoints=0x2 | out: lpPoints=0x55e4e8) returned -54525952 [0092.613] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.613] GetWindow (hWnd=0x502c2, uCmd=0x3) returned 0x0 [0092.613] SetWindowPos (hWnd=0x502c2, hWndInsertAfter=0x400ec, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0092.615] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e4a0 | out: lpRect=0x55e4a0) returned 1 [0092.615] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e4a0 | out: lpRect=0x55e4a0) returned 1 [0092.615] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.615] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e4a0, cPoints=0x2 | out: lpPoints=0x55e4a0) returned -54525952 [0092.615] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.615] GetWindow (hWnd=0x502c2, uCmd=0x3) returned 0x400ec [0092.615] GetFocus () returned 0x0 [0092.615] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.615] GetWindowLongW (hWnd=0x502c2, nIndex=-20) returned 0 [0092.615] DestroyWindow (hWnd=0x502c2) returned 1 [0092.617] GetClientRect (in: hWnd=0x502c2, lpRect=0x55e3d8 | out: lpRect=0x55e3d8) returned 1 [0092.617] GetWindowRect (in: hWnd=0x502c2, lpRect=0x55e3d8 | out: lpRect=0x55e3d8) returned 1 [0092.617] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.617] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55e3d8, cPoints=0x2 | out: lpPoints=0x55e3d8) returned -54525952 [0092.617] GetParent (hWnd=0x502c2) returned 0x701e2 [0092.617] GetWindowTextLengthW (hWnd=0x502c2) [0092.618] GetCurrentActCtx (in: lphActCtx=0x55e790 | out: lphActCtx=0x55e790*=0x769b1c) returned 1 [0092.618] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0092.619] GetModuleHandleW (lpModuleName=0x0) returned 0x70000 [0092.619] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=298, Y=12, nWidth=0, nHeight=0, hWndParent=0x701e2, hMenu=0x0, hInstance=0x70000, lpParam=0x0) returned 0x602c2 [0092.619] SetWindowLongW (hWnd=0x602c2, nIndex=-4, dwNewLong=1950089536) returned 77465062 [0092.619] GetWindowLongW (hWnd=0x602c2, nIndex=-4) returned 1950089536 [0092.620] SetWindowLongW (hWnd=0x602c2, nIndex=-4, dwNewLong=77478830) returned 1950089536 [0092.620] GetWindowLongW (hWnd=0x602c2, nIndex=-4) returned 77478830 [0092.620] GetWindowLongW (hWnd=0x602c2, nIndex=-16) returned 1174405120 [0092.620] GetWindowLongW (hWnd=0x602c2, nIndex=-12) returned 0 [0092.620] SetWindowLongW (hWnd=0x602c2, nIndex=-12, dwNewLong=393922) returned 0 [0092.621] GetClientRect (in: hWnd=0x602c2, lpRect=0x55de98 | out: lpRect=0x55de98) returned 1 [0092.621] GetWindowRect (in: hWnd=0x602c2, lpRect=0x55de98 | out: lpRect=0x55de98) returned 1 [0092.621] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.621] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55de98, cPoints=0x2 | out: lpPoints=0x55de98) returned -54525952 [0092.622] GetClientRect (in: hWnd=0x602c2, lpRect=0x55def0 | out: lpRect=0x55def0) returned 1 [0092.622] GetWindowRect (in: hWnd=0x602c2, lpRect=0x55def0 | out: lpRect=0x55def0) returned 1 [0092.622] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.622] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55def0, cPoints=0x2 | out: lpPoints=0x55def0) returned -54525952 [0092.622] SendMessageW (hWnd=0x602c2, Msg=0x2210, wParam=0x2c20001, lParam=0x602c2) [0092.623] GetClientRect (in: hWnd=0x602c2, lpRect=0x55dec0 | out: lpRect=0x55dec0) returned 1 [0092.623] GetWindowRect (in: hWnd=0x602c2, lpRect=0x55dec0 | out: lpRect=0x55dec0) returned 1 [0092.623] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.623] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x701e2, lpPoints=0x55dec0, cPoints=0x2 | out: lpPoints=0x55dec0) returned -54525952 [0092.623] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.623] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.623] GetParent (hWnd=0x8002e) returned 0x701e2 [0092.623] GetParent (hWnd=0x80036) returned 0x701e2 [0092.623] GetParent (hWnd=0x80030) returned 0x701e2 [0092.624] GetParent (hWnd=0x602b6) returned 0x701e2 [0092.624] GetParent (hWnd=0x19001c) returned 0x701e2 [0092.624] GetParent (hWnd=0x302c8) returned 0x701e2 [0092.624] GetParent (hWnd=0x400ec) returned 0x701e2 [0092.624] GetParent (hWnd=0x602c2) returned 0x701e2 [0092.625] SetWindowPlacement (hWnd=0x701e2, lpwndpl=0x55e92c) returned 1 [0092.625] GetWindowTextLengthW (hWnd=0x302c8) returned 54 [0092.625] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0092.625] GetSystemMetrics (nIndex=42) returned 0 [0092.625] GetWindowTextW (in: hWnd=0x302c8, lpString=0x55e830, nMaxCount=55 | out: lpString="Please send n Bitcoin(s) to the following BTC address:") returned 54 [0092.625] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0xd, wParam=0x37, lParam=0x55e830) returned 0x36 [0092.625] GetWindowTextLengthW (hWnd=0x302c8) returned 54 [0092.625] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x36 [0092.625] GetSystemMetrics (nIndex=42) returned 0 [0092.625] GetWindowTextW (in: hWnd=0x302c8, lpString=0x55e82c, nMaxCount=55 | out: lpString="Please send n Bitcoin(s) to the following BTC address:") returned 54 [0092.626] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0xd, wParam=0x37, lParam=0x55e82c) returned 0x36 [0092.626] SetWindowTextW (hWnd=0x302c8, lpString="Please send 1 Bitcoin(s) to the following BTC address:") returned 1 [0092.626] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0xc, wParam=0x0, lParam=0x2396c08) returned 0x1 [0092.626] GetStockObject (i=5) returned 0x900015 [0092.628] GetDlgItem (hDlg=0x701e2, nIDDlgItem=197320) returned 0x302c8 [0092.628] SendMessageW (hWnd=0x302c8, Msg=0x202b, wParam=0x302c8, lParam=0x55e394) returned 0x0 [0092.628] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x302c8, Msg=0x202b, wParam=0x302c8, lParam=0x55e394) returned 0x0 [0092.629] InvalidateRect (hWnd=0x302c8, lpRect=0x0, bErase=1) returned 1 [0092.629] GetWindowTextLengthW (hWnd=0x602b6) returned 34 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x22 [0092.629] GetSystemMetrics (nIndex=42) returned 0 [0092.629] GetWindowTextW (in: hWnd=0x602b6, lpString=0x55e858, nMaxCount=35 | out: lpString="1BtUL5dhVXHwKLqSdhjyjK9Pe64Vc6CEH1") returned 34 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x602b6, Msg=0xd, wParam=0x23, lParam=0x55e858) returned 0x22 [0092.629] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.629] GetSystemMetrics (nIndex=42) returned 0 [0092.629] GetWindowTextW (in: hWnd=0x80030, lpString=0x55e85c, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd, wParam=0x22, lParam=0x55e85c) returned 0x21 [0092.629] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.629] GetSystemMetrics (nIndex=42) returned 0 [0092.629] GetWindowTextW (in: hWnd=0x80030, lpString=0x55e844, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd, wParam=0x22, lParam=0x55e844) returned 0x21 [0092.629] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0092.629] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.629] GetSystemMetrics (nIndex=42) returned 0 [0092.630] GetWindowTextW (in: hWnd=0x80030, lpString=0x55e82c, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0092.630] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd, wParam=0x22, lParam=0x55e82c) returned 0x21 [0092.630] GetWindowTextLengthW (hWnd=0x80030) returned 33 [0092.630] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x21 [0092.630] GetSystemMetrics (nIndex=42) returned 0 [0092.630] GetWindowTextW (in: hWnd=0x80030, lpString=0x55e818, nMaxCount=34 | out: lpString="friendly.cyber.criminal@gmail.com") returned 33 [0092.630] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xd, wParam=0x22, lParam=0x55e818) returned 0x21 [0092.630] SetWindowTextW (hWnd=0x80030, lpString="this.email.address@gmail.com") returned 1 [0092.630] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xc, wParam=0x0, lParam=0x2396c84) returned 0x1 [0092.630] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x4000030, lParam=0x80030) returned 0x0 [0092.630] SendMessageW (hWnd=0x80030, Msg=0x2111, wParam=0x3000030, lParam=0x80030) returned 0x0 [0092.630] SendMessageW (hWnd=0x80030, Msg=0xb9, wParam=0x0, lParam=0x0) returned 0x1 [0092.630] CallWindowProcW (lpPrevWndFunc=0x6fb8d460, hWnd=0x80030, Msg=0xb9, wParam=0x0, lParam=0x0) returned 0x1 [0092.631] IsWindowVisible (hWnd=0x302c8) returned 1 [0092.631] IsWindowEnabled (hWnd=0x302c8) returned 1 [0092.631] SetFocus (hWnd=0x302c8) returned 0x0 [0092.631] GetFocus () returned 0x0 [0092.631] GetFocus () returned 0x0 [0092.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e8cc) returned 1 [0092.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0092.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0092.763] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x55e5f4 | out: lpFindFileData=0x55e5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa3b7090f, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xa3b7090f, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e1e8 [0092.767] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa3b7090f, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xa3b7090f, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.767] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2587c2c0, ftCreationTime.dwHighDateTime=0x1d5e15d, ftLastAccessTime.dwLowDateTime=0xf60f1130, ftLastAccessTime.dwHighDateTime=0x1d5e8a8, ftLastWriteTime.dwLowDateTime=0xf60f1130, ftLastWriteTime.dwHighDateTime=0x1d5e8a8, nFileSizeHigh=0x0, nFileSizeLow=0x2205, dwReserved0=0x0, dwReserved1=0x0, cFileName="0Mnb.png", cAlternateFileName="")) returned 1 [0092.767] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b633a50, ftCreationTime.dwHighDateTime=0x1d5f0a0, ftLastAccessTime.dwLowDateTime=0x2091e130, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0x2091e130, ftLastWriteTime.dwHighDateTime=0x1d5e250, nFileSizeHigh=0x0, nFileSizeLow=0xc522, dwReserved0=0x0, dwReserved1=0x0, cFileName="2GIJ.wav", cAlternateFileName="")) returned 1 [0092.768] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1007de30, ftCreationTime.dwHighDateTime=0x1d5f062, ftLastAccessTime.dwLowDateTime=0x586344a0, ftLastAccessTime.dwHighDateTime=0x1d5e133, ftLastWriteTime.dwLowDateTime=0x586344a0, ftLastWriteTime.dwHighDateTime=0x1d5e133, nFileSizeHigh=0x0, nFileSizeLow=0x1c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="3n8W.ods", cAlternateFileName="")) returned 1 [0092.768] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82426aa0, ftCreationTime.dwHighDateTime=0x1d5ef5f, ftLastAccessTime.dwLowDateTime=0xb1b18220, ftLastAccessTime.dwHighDateTime=0x1d5e227, ftLastWriteTime.dwLowDateTime=0xb1b18220, ftLastWriteTime.dwHighDateTime=0x1d5e227, nFileSizeHigh=0x0, nFileSizeLow=0x2e9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5eck_.swf", cAlternateFileName="")) returned 1 [0092.768] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5853eb90, ftCreationTime.dwHighDateTime=0x1d5ec19, ftLastAccessTime.dwLowDateTime=0x506144b0, ftLastAccessTime.dwHighDateTime=0x1d5edd0, ftLastWriteTime.dwLowDateTime=0x506144b0, ftLastWriteTime.dwHighDateTime=0x1d5edd0, nFileSizeHigh=0x0, nFileSizeLow=0x1539, dwReserved0=0x0, dwReserved1=0x0, cFileName="6McAIlu.flv", cAlternateFileName="")) returned 1 [0092.768] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde675890, ftCreationTime.dwHighDateTime=0x1d5ed02, ftLastAccessTime.dwLowDateTime=0xfde743a0, ftLastAccessTime.dwHighDateTime=0x1d5e56f, ftLastWriteTime.dwLowDateTime=0xfde743a0, ftLastWriteTime.dwHighDateTime=0x1d5e56f, nFileSizeHigh=0x0, nFileSizeLow=0x25aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="6TA_p.png", cAlternateFileName="")) returned 1 [0092.768] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc59067b0, ftCreationTime.dwHighDateTime=0x1d5e156, ftLastAccessTime.dwLowDateTime=0x33158bd0, ftLastAccessTime.dwHighDateTime=0x1d5f08e, ftLastWriteTime.dwLowDateTime=0x33158bd0, ftLastWriteTime.dwHighDateTime=0x1d5f08e, nFileSizeHigh=0x0, nFileSizeLow=0xbcd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="b25tnbE7E9J_0.avi", cAlternateFileName="B25TNB~1.AVI")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52c82d70, ftCreationTime.dwHighDateTime=0x1d5e0e9, ftLastAccessTime.dwLowDateTime=0x5d7a3c40, ftLastAccessTime.dwHighDateTime=0x1d5e913, ftLastWriteTime.dwLowDateTime=0x5d7a3c40, ftLastWriteTime.dwHighDateTime=0x1d5e913, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNJ0jBHn-o_ZP8Vg6.odt", cAlternateFileName="DNJ0JB~1.ODT")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x522eb2d0, ftCreationTime.dwHighDateTime=0x1d5ec3d, ftLastAccessTime.dwLowDateTime=0xb2522f40, ftLastAccessTime.dwHighDateTime=0x1d5ef6a, ftLastWriteTime.dwLowDateTime=0xb2522f40, ftLastWriteTime.dwHighDateTime=0x1d5ef6a, nFileSizeHigh=0x0, nFileSizeLow=0xfc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="dYdI-w6n3_m3jFmc.avi", cAlternateFileName="DYDI-W~1.AVI")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb63e2fe0, ftCreationTime.dwHighDateTime=0x1d5e63d, ftLastAccessTime.dwLowDateTime=0xa652ef80, ftLastAccessTime.dwHighDateTime=0x1d5e70a, ftLastWriteTime.dwLowDateTime=0xa652ef80, ftLastWriteTime.dwHighDateTime=0x1d5e70a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fHg-hO_jKW", cAlternateFileName="FHG-HO~1")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66362720, ftCreationTime.dwHighDateTime=0x1d5e55a, ftLastAccessTime.dwLowDateTime=0xd8ab8240, ftLastAccessTime.dwHighDateTime=0x1d5ef92, ftLastWriteTime.dwLowDateTime=0xd8ab8240, ftLastWriteTime.dwHighDateTime=0x1d5ef92, nFileSizeHigh=0x0, nFileSizeLow=0x114a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsBK-C-.gif", cAlternateFileName="")) returned 1 [0092.769] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba317c40, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6c02a380, ftLastAccessTime.dwHighDateTime=0x1d5e1ff, ftLastWriteTime.dwLowDateTime=0x6c02a380, ftLastWriteTime.dwHighDateTime=0x1d5e1ff, nFileSizeHigh=0x0, nFileSizeLow=0x4b91, dwReserved0=0x0, dwReserved1=0x0, cFileName="gpuqXEpWWbQue.bmp", cAlternateFileName="GPUQXE~1.BMP")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74683aa0, ftCreationTime.dwHighDateTime=0x1d5e752, ftLastAccessTime.dwLowDateTime=0xc5710290, ftLastAccessTime.dwHighDateTime=0x1d5e3f8, ftLastWriteTime.dwLowDateTime=0xc5710290, ftLastWriteTime.dwHighDateTime=0x1d5e3f8, nFileSizeHigh=0x0, nFileSizeLow=0x55a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gqx6hadX8BA.bmp", cAlternateFileName="GQX6HA~1.BMP")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1ee100, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0x8e1ee100, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0x5adc5200, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x14c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="GUkwRkMToehNH8CZ.exe", cAlternateFileName="GUKWRK~1.EXE")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4041bc30, ftCreationTime.dwHighDateTime=0x1d5ef11, ftLastAccessTime.dwLowDateTime=0xb681ba50, ftLastAccessTime.dwHighDateTime=0x1d5ec58, ftLastWriteTime.dwLowDateTime=0xb681ba50, ftLastWriteTime.dwHighDateTime=0x1d5ec58, nFileSizeHigh=0x0, nFileSizeLow=0xa0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="i-0k4yYW1a4hw2g T.bmp", cAlternateFileName="I-0K4Y~1.BMP")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81fc26b0, ftCreationTime.dwHighDateTime=0x1d5e3d6, ftLastAccessTime.dwLowDateTime=0x597955e0, ftLastAccessTime.dwHighDateTime=0x1d5e841, ftLastWriteTime.dwLowDateTime=0x597955e0, ftLastWriteTime.dwHighDateTime=0x1d5e841, nFileSizeHigh=0x0, nFileSizeLow=0x4fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IKOqr_J1pn.png", cAlternateFileName="IKOQR_~1.PNG")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52968f10, ftCreationTime.dwHighDateTime=0x1d5e1fa, ftLastAccessTime.dwLowDateTime=0xecfc7020, ftLastAccessTime.dwHighDateTime=0x1d5f059, ftLastWriteTime.dwLowDateTime=0xecfc7020, ftLastWriteTime.dwHighDateTime=0x1d5f059, nFileSizeHigh=0x0, nFileSizeLow=0xd579, dwReserved0=0x0, dwReserved1=0x0, cFileName="JeVZhkf.odt", cAlternateFileName="")) returned 1 [0092.770] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fb00e0, ftCreationTime.dwHighDateTime=0x1d5eef9, ftLastAccessTime.dwLowDateTime=0xb0133040, ftLastAccessTime.dwHighDateTime=0x1d5e4ec, ftLastWriteTime.dwLowDateTime=0xb0133040, ftLastWriteTime.dwHighDateTime=0x1d5e4ec, nFileSizeHigh=0x0, nFileSizeLow=0xe25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="q0UQM2MwRc1Vr.xls", cAlternateFileName="Q0UQM2~1.XLS")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0190e0, ftCreationTime.dwHighDateTime=0x1d5e395, ftLastAccessTime.dwLowDateTime=0xafe74910, ftLastAccessTime.dwHighDateTime=0x1d5eba1, ftLastWriteTime.dwLowDateTime=0xafe74910, ftLastWriteTime.dwHighDateTime=0x1d5eba1, nFileSizeHigh=0x0, nFileSizeLow=0x9dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="qMq3V8.bmp", cAlternateFileName="")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc4aecb0, ftCreationTime.dwHighDateTime=0x1d5e669, ftLastAccessTime.dwLowDateTime=0x6d92cd20, ftLastAccessTime.dwHighDateTime=0x1d5edf7, ftLastWriteTime.dwLowDateTime=0x6d92cd20, ftLastWriteTime.dwHighDateTime=0x1d5edf7, nFileSizeHigh=0x0, nFileSizeLow=0xa82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="r1R8D0I09w-.mp3", cAlternateFileName="R1R8D0~1.MP3")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x497efb00, ftCreationTime.dwHighDateTime=0x1d5e584, ftLastAccessTime.dwLowDateTime=0xb62b0410, ftLastAccessTime.dwHighDateTime=0x1d5e9c1, ftLastWriteTime.dwLowDateTime=0xb62b0410, ftLastWriteTime.dwHighDateTime=0x1d5e9c1, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="sj3WPR.mp4", cAlternateFileName="")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83668450, ftCreationTime.dwHighDateTime=0x1d5eba6, ftLastAccessTime.dwLowDateTime=0x54931b80, ftLastAccessTime.dwHighDateTime=0x1d5ef65, ftLastWriteTime.dwLowDateTime=0x54931b80, ftLastWriteTime.dwHighDateTime=0x1d5ef65, nFileSizeHigh=0x0, nFileSizeLow=0xc285, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUX06h6gh3H.wav", cAlternateFileName="SUX06H~1.WAV")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d525a0, ftCreationTime.dwHighDateTime=0x1d5ea71, ftLastAccessTime.dwLowDateTime=0xba5ec160, ftLastAccessTime.dwHighDateTime=0x1d5e64d, ftLastWriteTime.dwLowDateTime=0xba5ec160, ftLastWriteTime.dwHighDateTime=0x1d5e64d, nFileSizeHigh=0x0, nFileSizeLow=0x15d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="tHqddNTEmxHBh v.avi", cAlternateFileName="THQDDN~1.AVI")) returned 1 [0092.771] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0835df0, ftCreationTime.dwHighDateTime=0x1d5e788, ftLastAccessTime.dwLowDateTime=0x8bc1ede0, ftLastAccessTime.dwHighDateTime=0x1d5f02b, ftLastWriteTime.dwLowDateTime=0x8bc1ede0, ftLastWriteTime.dwHighDateTime=0x1d5f02b, nFileSizeHigh=0x0, nFileSizeLow=0x5f74, dwReserved0=0x0, dwReserved1=0x0, cFileName="TYYDb.avi", cAlternateFileName="")) returned 1 [0092.772] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d261ba0, ftCreationTime.dwHighDateTime=0x1d5e9f2, ftLastAccessTime.dwLowDateTime=0x72bfd750, ftLastAccessTime.dwHighDateTime=0x1d5eb6f, ftLastWriteTime.dwLowDateTime=0x72bfd750, ftLastWriteTime.dwHighDateTime=0x1d5eb6f, nFileSizeHigh=0x0, nFileSizeLow=0x13424, dwReserved0=0x0, dwReserved1=0x0, cFileName="ULZUv8EGbak.mp3", cAlternateFileName="ULZUV8~1.MP3")) returned 1 [0092.772] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77798770, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0x20fa4050, ftLastAccessTime.dwHighDateTime=0x1d5e9ed, ftLastWriteTime.dwLowDateTime=0x20fa4050, ftLastWriteTime.dwHighDateTime=0x1d5e9ed, nFileSizeHigh=0x0, nFileSizeLow=0x1765d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vC-IvX9R aI.odp", cAlternateFileName="VC-IVX~1.ODP")) returned 1 [0092.772] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73bb9230, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0x6bcffe80, ftLastAccessTime.dwHighDateTime=0x1d5f118, ftLastWriteTime.dwLowDateTime=0x6bcffe80, ftLastWriteTime.dwHighDateTime=0x1d5f118, nFileSizeHigh=0x0, nFileSizeLow=0x16607, dwReserved0=0x0, dwReserved1=0x0, cFileName="vQvd6l7zI3-b0.wav", cAlternateFileName="VQVD6L~1.WAV")) returned 1 [0092.772] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd47a0010, ftCreationTime.dwHighDateTime=0x1d5e2b9, ftLastAccessTime.dwLowDateTime=0x3037e5d0, ftLastAccessTime.dwHighDateTime=0x1d5ef66, ftLastWriteTime.dwLowDateTime=0x3037e5d0, ftLastWriteTime.dwHighDateTime=0x1d5ef66, nFileSizeHigh=0x0, nFileSizeLow=0x3540, dwReserved0=0x0, dwReserved1=0x0, cFileName="W25OGUbJ.jpg", cAlternateFileName="")) returned 1 [0092.772] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60c5a60, ftCreationTime.dwHighDateTime=0x1d5ed7d, ftLastAccessTime.dwLowDateTime=0x68eb27f0, ftLastAccessTime.dwHighDateTime=0x1d5e43c, ftLastWriteTime.dwLowDateTime=0x68eb27f0, ftLastWriteTime.dwHighDateTime=0x1d5e43c, nFileSizeHigh=0x0, nFileSizeLow=0x16458, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsZngNKt5W7D6e.mkv", cAlternateFileName="WSZNGN~1.MKV")) returned 1 [0092.773] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a4a2d0, ftCreationTime.dwHighDateTime=0x1d5ed55, ftLastAccessTime.dwLowDateTime=0xf84aa3a0, ftLastAccessTime.dwHighDateTime=0x1d5e787, ftLastWriteTime.dwLowDateTime=0xf84aa3a0, ftLastWriteTime.dwHighDateTime=0x1d5e787, nFileSizeHigh=0x0, nFileSizeLow=0x1860e, dwReserved0=0x0, dwReserved1=0x0, cFileName="XNQTtSnDT9mD7.mp3", cAlternateFileName="XNQTTS~1.MP3")) returned 1 [0092.773] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2dae120, ftCreationTime.dwHighDateTime=0x1d5e59b, ftLastAccessTime.dwLowDateTime=0x3623cbd0, ftLastAccessTime.dwHighDateTime=0x1d5ea70, ftLastWriteTime.dwLowDateTime=0x3623cbd0, ftLastWriteTime.dwHighDateTime=0x1d5ea70, nFileSizeHigh=0x0, nFileSizeLow=0x98bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="xYXSJGQ-Udq.gif", cAlternateFileName="XYXSJG~1.GIF")) returned 1 [0092.773] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b707c0, ftCreationTime.dwHighDateTime=0x1d5e9aa, ftLastAccessTime.dwLowDateTime=0xe678d900, ftLastAccessTime.dwHighDateTime=0x1d5e951, ftLastWriteTime.dwLowDateTime=0xe678d900, ftLastWriteTime.dwHighDateTime=0x1d5e951, nFileSizeHigh=0x0, nFileSizeLow=0xb3e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="YgTZjyNS.mkv", cAlternateFileName="")) returned 1 [0092.773] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c892cd0, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0xa339e7b0, ftLastAccessTime.dwHighDateTime=0x1d5ec44, ftLastWriteTime.dwLowDateTime=0xa339e7b0, ftLastWriteTime.dwHighDateTime=0x1d5ec44, nFileSizeHigh=0x0, nFileSizeLow=0x17612, dwReserved0=0x0, dwReserved1=0x0, cFileName="yndUVKcf ci.bmp", cAlternateFileName="YNDUVK~1.BMP")) returned 1 [0092.773] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ceaf770, ftCreationTime.dwHighDateTime=0x1d5ef83, ftLastAccessTime.dwLowDateTime=0x358ec660, ftLastAccessTime.dwHighDateTime=0x1d5e710, ftLastWriteTime.dwLowDateTime=0x358ec660, ftLastWriteTime.dwHighDateTime=0x1d5e710, nFileSizeHigh=0x0, nFileSizeLow=0xd161, dwReserved0=0x0, dwReserved1=0x0, cFileName="yNzYi 0FTK3nP9JGuU49.ppt", cAlternateFileName="YNZYI0~1.PPT")) returned 1 [0092.774] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14caa5f0, ftCreationTime.dwHighDateTime=0x1d5eb4a, ftLastAccessTime.dwLowDateTime=0xedecd7a0, ftLastAccessTime.dwHighDateTime=0x1d5e4f5, ftLastWriteTime.dwLowDateTime=0xedecd7a0, ftLastWriteTime.dwHighDateTime=0x1d5e4f5, nFileSizeHigh=0x0, nFileSizeLow=0x5718, dwReserved0=0x0, dwReserved1=0x0, cFileName="YoTdz-eSdn-Cub0hOh44.png", cAlternateFileName="YOTDZ-~1.PNG")) returned 1 [0092.774] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed588390, ftCreationTime.dwHighDateTime=0x1d5f03d, ftLastAccessTime.dwLowDateTime=0x9d9bd540, ftLastAccessTime.dwHighDateTime=0x1d5e170, ftLastWriteTime.dwLowDateTime=0x9d9bd540, ftLastWriteTime.dwHighDateTime=0x1d5e170, nFileSizeHigh=0x0, nFileSizeLow=0x82c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="z5DDQ8NJ SfKbxrCrjXc.pdf", cAlternateFileName="Z5DDQ8~1.PDF")) returned 1 [0092.774] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdad6000, ftCreationTime.dwHighDateTime=0x1d5ea32, ftLastAccessTime.dwLowDateTime=0xc6852d00, ftLastAccessTime.dwHighDateTime=0x1d5ef01, ftLastWriteTime.dwLowDateTime=0xc6852d00, ftLastWriteTime.dwHighDateTime=0x1d5ef01, nFileSizeHigh=0x0, nFileSizeLow=0x108dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZNVryRkVU.jpg", cAlternateFileName="ZNVRYR~1.JPG")) returned 1 [0092.774] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.774] FindClose (in: hFindFile=0x76e1e8 | out: hFindFile=0x76e1e8) returned 1 [0092.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e888) returned 1 [0092.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e894) returned 1 [0092.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0094.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0094.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png.jcrypt", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png.jcrypt", lpFilePart=0x0) returned 0x27 [0094.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0094.090] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\0mnb.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0094.091] GetFileType (hFile=0x3f4) returned 0x1 [0094.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0094.091] GetFileType (hFile=0x3f4) returned 0x1 [0094.100] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x55e830 | out: pfEnabled=0x55e830) returned 0x0 [0102.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0102.182] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", lpFilePart=0x0) returned 0x20 [0102.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0102.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0mnb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0102.183] GetFileType (hFile=0x35c) returned 0x1 [0102.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0102.183] GetFileType (hFile=0x35c) returned 0x1 [0102.186] ReadFile (in: hFile=0x35c, lpBuffer=0x35e75f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35e75f8*, lpNumberOfBytesRead=0x55e7f8*=0x2205, lpOverlapped=0x0) returned 1 [0102.319] WriteFile (in: hFile=0x3f4, lpBuffer=0x24675bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24675bc*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0102.320] WriteFile (in: hFile=0x3f4, lpBuffer=0x246dc40*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x246dc40*, lpNumberOfBytesWritten=0x55e7d0*=0x1220, lpOverlapped=0x0) returned 1 [0102.320] ReadFile (in: hFile=0x35c, lpBuffer=0x35e75f8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35e75f8*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0102.321] CloseHandle (hObject=0x35c) returned 1 [0102.321] WriteFile (in: hFile=0x3f4, lpBuffer=0x24675bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24675bc*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0102.321] CloseHandle (hObject=0x3f4) returned 1 [0102.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0102.324] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png", lpFilePart=0x0) returned 0x20 [0102.324] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0Mnb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0mnb.png")) returned 1 [0102.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0102.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav.jcrypt", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav.jcrypt", lpFilePart=0x0) returned 0x27 [0102.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0102.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\2gij.wav.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0102.327] GetFileType (hFile=0x3f4) returned 0x1 [0102.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0102.327] GetFileType (hFile=0x3f4) returned 0x1 [0107.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0107.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", lpFilePart=0x0) returned 0x20 [0107.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0107.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\2gij.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0107.629] GetFileType (hFile=0x35c) returned 0x1 [0107.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0107.629] GetFileType (hFile=0x35c) returned 0x1 [0107.633] ReadFile (in: hFile=0x35c, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xc522, lpOverlapped=0x0) returned 1 [0107.760] WriteFile (in: hFile=0x3f4, lpBuffer=0x25540bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25540bc*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0107.761] WriteFile (in: hFile=0x3f4, lpBuffer=0x2556580*, nNumberOfBytesToWrite=0xb540, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2556580*, lpNumberOfBytesWritten=0x55e7d0*=0xb540, lpOverlapped=0x0) returned 1 [0107.763] ReadFile (in: hFile=0x35c, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0107.763] CloseHandle (hObject=0x35c) returned 1 [0107.763] WriteFile (in: hFile=0x3f4, lpBuffer=0x25540bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x25540bc*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0107.763] CloseHandle (hObject=0x3f4) returned 1 [0107.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0107.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav", lpFilePart=0x0) returned 0x20 [0107.770] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2GIJ.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\2gij.wav")) returned 1 [0107.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0107.775] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods.jcrypt", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods.jcrypt", lpFilePart=0x0) returned 0x27 [0107.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0107.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\3n8w.ods.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0107.775] GetFileType (hFile=0x3f4) returned 0x1 [0107.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0107.775] GetFileType (hFile=0x3f4) returned 0x1 [0112.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0112.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", lpFilePart=0x0) returned 0x20 [0112.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0112.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\3n8w.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0112.099] GetFileType (hFile=0x35c) returned 0x1 [0112.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0112.099] GetFileType (hFile=0x35c) returned 0x1 [0112.102] ReadFile (in: hFile=0x35c, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x1c1d, lpOverlapped=0x0) returned 1 [0112.169] WriteFile (in: hFile=0x3f4, lpBuffer=0x244432c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x244432c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0112.171] ReadFile (in: hFile=0x35c, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0112.171] CloseHandle (hObject=0x35c) returned 1 [0112.171] WriteFile (in: hFile=0x3f4, lpBuffer=0x244432c*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x244432c*, lpNumberOfBytesWritten=0x55e798*=0xc40, lpOverlapped=0x0) returned 1 [0112.171] CloseHandle (hObject=0x3f4) returned 1 [0112.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0112.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", nBufferLength=0x21, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods", lpFilePart=0x0) returned 0x20 [0112.173] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\3n8W.ods" (normalized: "c:\\users\\fd1hvy\\desktop\\3n8w.ods")) returned 1 [0112.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0112.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf.jcrypt", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf.jcrypt", lpFilePart=0x0) returned 0x28 [0112.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0112.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\5eck_.swf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0112.176] GetFileType (hFile=0x3f4) returned 0x1 [0112.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0112.177] GetFileType (hFile=0x3f4) returned 0x1 [0115.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0115.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", lpFilePart=0x0) returned 0x21 [0115.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0115.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\5eck_.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0115.231] GetFileType (hFile=0x35c) returned 0x1 [0115.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0115.231] GetFileType (hFile=0x35c) returned 0x1 [0115.234] ReadFile (in: hFile=0x35c, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x2e9d, lpOverlapped=0x0) returned 1 [0115.265] WriteFile (in: hFile=0x3f4, lpBuffer=0x2526a6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2526a6c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0115.266] WriteFile (in: hFile=0x3f4, lpBuffer=0x2528f30*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2528f30*, lpNumberOfBytesWritten=0x55e7d0*=0x1eb0, lpOverlapped=0x0) returned 1 [0115.267] ReadFile (in: hFile=0x35c, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0115.267] CloseHandle (hObject=0x35c) returned 1 [0115.267] WriteFile (in: hFile=0x3f4, lpBuffer=0x2526a6c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2526a6c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0115.267] CloseHandle (hObject=0x3f4) returned 1 [0115.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0115.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf", lpFilePart=0x0) returned 0x21 [0115.361] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5eck_.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\5eck_.swf")) returned 1 [0115.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0115.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv.jcrypt", lpFilePart=0x0) returned 0x2a [0115.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0115.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\6mcailu.flv.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0115.365] GetFileType (hFile=0x3f4) returned 0x1 [0115.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0115.365] GetFileType (hFile=0x3f4) returned 0x1 [0118.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0118.885] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", lpFilePart=0x0) returned 0x23 [0118.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0118.885] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\6mcailu.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0118.885] GetFileType (hFile=0x378) returned 0x1 [0118.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0118.886] GetFileType (hFile=0x378) returned 0x1 [0118.889] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x1539, lpOverlapped=0x0) returned 1 [0118.976] WriteFile (in: hFile=0x3f4, lpBuffer=0x240eb74*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x240eb74*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0118.978] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0118.978] CloseHandle (hObject=0x378) returned 1 [0118.978] WriteFile (in: hFile=0x3f4, lpBuffer=0x240eb74*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x240eb74*, lpNumberOfBytesWritten=0x55e798*=0x560, lpOverlapped=0x0) returned 1 [0118.979] CloseHandle (hObject=0x3f4) returned 1 [0118.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0118.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv", lpFilePart=0x0) returned 0x23 [0118.980] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6McAIlu.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\6mcailu.flv")) returned 1 [0118.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0118.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png.jcrypt", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png.jcrypt", lpFilePart=0x0) returned 0x28 [0118.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0118.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\6ta_p.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0118.984] GetFileType (hFile=0x3f4) returned 0x1 [0118.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0118.984] GetFileType (hFile=0x3f4) returned 0x1 [0121.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0121.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", lpFilePart=0x0) returned 0x21 [0121.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0121.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6ta_p.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0121.202] GetFileType (hFile=0x378) returned 0x1 [0121.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0121.202] GetFileType (hFile=0x378) returned 0x1 [0121.206] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x25aa, lpOverlapped=0x0) returned 1 [0121.227] WriteFile (in: hFile=0x3f4, lpBuffer=0x24f3bf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24f3bf0*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0121.228] WriteFile (in: hFile=0x3f4, lpBuffer=0x24f60b4*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24f60b4*, lpNumberOfBytesWritten=0x55e7d0*=0x15c0, lpOverlapped=0x0) returned 1 [0121.229] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0121.229] CloseHandle (hObject=0x378) returned 1 [0121.229] WriteFile (in: hFile=0x3f4, lpBuffer=0x24f3bf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24f3bf0*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0121.229] CloseHandle (hObject=0x3f4) returned 1 [0121.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0121.253] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png", lpFilePart=0x0) returned 0x21 [0121.253] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6TA_p.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6ta_p.png")) returned 1 [0121.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.308] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi.jcrypt", lpFilePart=0x0) returned 0x30 [0121.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0121.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\b25tnbe7e9j_0.avi.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0121.339] GetFileType (hFile=0x3f4) returned 0x1 [0121.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0121.340] GetFileType (hFile=0x3f4) returned 0x1 [0124.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0124.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", lpFilePart=0x0) returned 0x29 [0124.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0124.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\b25tnbe7e9j_0.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0124.202] GetFileType (hFile=0x378) returned 0x1 [0124.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0124.202] GetFileType (hFile=0x378) returned 0x1 [0124.206] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0xbcd8, lpOverlapped=0x0) returned 1 [0124.264] WriteFile (in: hFile=0x3f4, lpBuffer=0x23d9d98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23d9d98*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0124.267] WriteFile (in: hFile=0x3f4, lpBuffer=0x23dc26c*, nNumberOfBytesToWrite=0xacf0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23dc26c*, lpNumberOfBytesWritten=0x55e7d0*=0xacf0, lpOverlapped=0x0) returned 1 [0124.268] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0124.268] CloseHandle (hObject=0x378) returned 1 [0124.268] WriteFile (in: hFile=0x3f4, lpBuffer=0x23d9d98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23d9d98*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0124.269] CloseHandle (hObject=0x3f4) returned 1 [0124.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0124.316] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi", lpFilePart=0x0) returned 0x29 [0124.316] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\b25tnbE7E9J_0.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\b25tnbe7e9j_0.avi")) returned 1 [0124.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x2a [0124.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0124.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0124.350] GetFileType (hFile=0x3f4) returned 0x1 [0124.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0124.351] GetFileType (hFile=0x3f4) returned 0x1 [0126.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0126.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23 [0126.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0126.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0126.900] GetFileType (hFile=0x378) returned 0x1 [0126.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0126.900] GetFileType (hFile=0x378) returned 0x1 [0126.903] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x11a, lpOverlapped=0x0) returned 1 [0126.916] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0126.917] CloseHandle (hObject=0x378) returned 1 [0126.917] WriteFile (in: hFile=0x3f4, lpBuffer=0x24c97c8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24c97c8*, lpNumberOfBytesWritten=0x55e798*=0x140, lpOverlapped=0x0) returned 1 [0126.919] CloseHandle (hObject=0x3f4) returned 1 [0126.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0126.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x23 [0126.924] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini")) returned 1 [0126.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0126.938] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt.jcrypt", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt.jcrypt", lpFilePart=0x0) returned 0x34 [0126.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0126.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\dnj0jbhn-o_zp8vg6.odt.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0126.946] GetFileType (hFile=0x3f4) returned 0x1 [0126.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0126.946] GetFileType (hFile=0x3f4) returned 0x1 [0129.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0129.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", lpFilePart=0x0) returned 0x2d [0129.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0129.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\dnj0jbhn-o_zp8vg6.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0129.881] GetFileType (hFile=0x378) returned 0x1 [0129.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0129.881] GetFileType (hFile=0x378) returned 0x1 [0129.884] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x9e00, lpOverlapped=0x0) returned 1 [0129.902] WriteFile (in: hFile=0x3f4, lpBuffer=0x23abf18*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23abf18*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0129.903] WriteFile (in: hFile=0x3f4, lpBuffer=0x23ae3f4*, nNumberOfBytesToWrite=0x8e20, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23ae3f4*, lpNumberOfBytesWritten=0x55e7d0*=0x8e20, lpOverlapped=0x0) returned 1 [0129.904] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0129.904] CloseHandle (hObject=0x378) returned 1 [0129.905] WriteFile (in: hFile=0x3f4, lpBuffer=0x23abf18*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23abf18*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0129.905] CloseHandle (hObject=0x3f4) returned 1 [0129.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0129.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt", lpFilePart=0x0) returned 0x2d [0129.914] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\DNJ0jBHn-o_ZP8Vg6.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\dnj0jbhn-o_zp8vg6.odt")) returned 1 [0129.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0129.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi.jcrypt", lpFilePart=0x0) returned 0x33 [0129.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0129.931] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\dydi-w6n3_m3jfmc.avi.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0129.938] GetFileType (hFile=0x3f4) returned 0x1 [0129.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0129.938] GetFileType (hFile=0x3f4) returned 0x1 [0131.857] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0131.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", lpFilePart=0x0) returned 0x2c [0131.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0131.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\dydi-w6n3_m3jfmc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0131.858] GetFileType (hFile=0x378) returned 0x1 [0131.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0131.858] GetFileType (hFile=0x378) returned 0x1 [0131.863] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0xfc72, lpOverlapped=0x0) returned 1 [0131.887] WriteFile (in: hFile=0x3f4, lpBuffer=0x24983a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24983a8*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0131.889] WriteFile (in: hFile=0x3f4, lpBuffer=0x249a884*, nNumberOfBytesToWrite=0xec90, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x249a884*, lpNumberOfBytesWritten=0x55e7d0*=0xec90, lpOverlapped=0x0) returned 1 [0131.890] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0131.890] CloseHandle (hObject=0x378) returned 1 [0131.891] WriteFile (in: hFile=0x3f4, lpBuffer=0x24983a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24983a8*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0131.891] CloseHandle (hObject=0x3f4) returned 1 [0131.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0131.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi", lpFilePart=0x0) returned 0x2c [0131.894] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dYdI-w6n3_m3jFmc.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\dydi-w6n3_m3jfmc.avi")) returned 1 [0131.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif.jcrypt", lpFilePart=0x0) returned 0x2a [0131.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0131.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\fsbk-c-.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0132.010] GetFileType (hFile=0x3f4) returned 0x1 [0132.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0132.010] GetFileType (hFile=0x3f4) returned 0x1 [0133.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0133.864] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", lpFilePart=0x0) returned 0x23 [0133.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0133.864] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\fsbk-c-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0133.865] GetFileType (hFile=0x378) returned 0x1 [0133.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0133.865] GetFileType (hFile=0x378) returned 0x1 [0133.868] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x114a8, lpOverlapped=0x0) returned 1 [0133.881] WriteFile (in: hFile=0x3f4, lpBuffer=0x238d1b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x238d1b0*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0133.882] WriteFile (in: hFile=0x3f4, lpBuffer=0x238f678*, nNumberOfBytesToWrite=0x104c0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x238f678*, lpNumberOfBytesWritten=0x55e7d0*=0x104c0, lpOverlapped=0x0) returned 1 [0133.883] ReadFile (in: hFile=0x378, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0133.883] CloseHandle (hObject=0x378) returned 1 [0133.883] WriteFile (in: hFile=0x3f4, lpBuffer=0x238d1b0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x238d1b0*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0133.884] CloseHandle (hObject=0x3f4) returned 1 [0133.893] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0133.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif", lpFilePart=0x0) returned 0x23 [0133.897] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fsBK-C-.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\fsbk-c-.gif")) returned 1 [0133.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0133.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp.jcrypt", lpFilePart=0x0) returned 0x30 [0133.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0133.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\gpuqxepwwbque.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0133.907] GetFileType (hFile=0x3f4) returned 0x1 [0133.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0133.907] GetFileType (hFile=0x3f4) returned 0x1 [0136.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0136.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", lpFilePart=0x0) returned 0x29 [0136.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0136.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gpuqxepwwbque.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0136.544] GetFileType (hFile=0x378) returned 0x1 [0136.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0136.544] GetFileType (hFile=0x378) returned 0x1 [0136.547] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x4b91, lpOverlapped=0x0) returned 1 [0136.565] WriteFile (in: hFile=0x3f4, lpBuffer=0x2480d9c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2480d9c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0136.566] WriteFile (in: hFile=0x3f4, lpBuffer=0x2483270*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2483270*, lpNumberOfBytesWritten=0x55e7d0*=0x3bb0, lpOverlapped=0x0) returned 1 [0136.567] ReadFile (in: hFile=0x378, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0136.568] CloseHandle (hObject=0x378) returned 1 [0136.568] WriteFile (in: hFile=0x3f4, lpBuffer=0x2480d9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2480d9c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0136.568] CloseHandle (hObject=0x3f4) returned 1 [0136.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0136.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp", lpFilePart=0x0) returned 0x29 [0136.577] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\gpuqXEpWWbQue.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gpuqxepwwbque.bmp")) returned 1 [0136.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0136.590] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp.jcrypt", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp.jcrypt", lpFilePart=0x0) returned 0x2e [0136.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0136.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\gqx6hadx8ba.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0136.596] GetFileType (hFile=0x3f4) returned 0x1 [0136.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0136.596] GetFileType (hFile=0x3f4) returned 0x1 [0139.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0139.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", lpFilePart=0x0) returned 0x27 [0139.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0139.265] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gqx6hadx8ba.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0139.265] GetFileType (hFile=0x378) returned 0x1 [0139.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0139.265] GetFileType (hFile=0x378) returned 0x1 [0139.297] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x55a1, lpOverlapped=0x0) returned 1 [0139.313] WriteFile (in: hFile=0x3f4, lpBuffer=0x2568098*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2568098*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0139.314] WriteFile (in: hFile=0x3f4, lpBuffer=0x256a568*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x256a568*, lpNumberOfBytesWritten=0x55e7d0*=0x45c0, lpOverlapped=0x0) returned 1 [0139.315] ReadFile (in: hFile=0x378, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0139.315] CloseHandle (hObject=0x378) returned 1 [0139.316] WriteFile (in: hFile=0x3f4, lpBuffer=0x2568098*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2568098*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0139.316] CloseHandle (hObject=0x3f4) returned 1 [0139.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0139.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp", lpFilePart=0x0) returned 0x27 [0139.453] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Gqx6hadX8BA.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\gqx6hadx8ba.bmp")) returned 1 [0139.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0139.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.jcrypt", lpFilePart=0x0) returned 0x33 [0139.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0139.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe.jcrypt" (normalized: "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0139.469] GetFileType (hFile=0x3f4) returned 0x1 [0139.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0139.469] GetFileType (hFile=0x3f4) returned 0x1 [0141.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0141.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe", lpFilePart=0x0) returned 0x2c [0141.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0141.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GUkwRkMToehNH8CZ.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gukwrkmtoehnh8cz.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0141.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55cae0) returned 1 [0141.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e8cc) returned 1 [0141.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0141.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0141.876] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x55e5f4 | out: lpFindFileData=0x55e5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6ee8ef5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6ee8ef5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e468 [0141.876] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6ee8ef5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6ee8ef5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992b4210, ftCreationTime.dwHighDateTime=0x1d5e87e, ftLastAccessTime.dwLowDateTime=0xf24886f0, ftLastAccessTime.dwHighDateTime=0x1d5e18f, ftLastWriteTime.dwLowDateTime=0xf24886f0, ftLastWriteTime.dwHighDateTime=0x1d5e18f, nFileSizeHigh=0x0, nFileSizeLow=0x9ebc, dwReserved0=0x0, dwReserved1=0x0, cFileName="4M-h.bmp", cAlternateFileName="")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x679c720, ftCreationTime.dwHighDateTime=0x1d5e7a2, ftLastAccessTime.dwLowDateTime=0x58471040, ftLastAccessTime.dwHighDateTime=0x1d5e116, ftLastWriteTime.dwLowDateTime=0x58471040, ftLastWriteTime.dwHighDateTime=0x1d5e116, nFileSizeHigh=0x0, nFileSizeLow=0xc8fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Z 0lVLaokIpDMbCn.png", cAlternateFileName="7Z0LVL~1.PNG")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98cd8e0, ftCreationTime.dwHighDateTime=0x1d5ee44, ftLastAccessTime.dwLowDateTime=0xe1591150, ftLastAccessTime.dwHighDateTime=0x1d5e8d0, ftLastWriteTime.dwLowDateTime=0xe1591150, ftLastWriteTime.dwHighDateTime=0x1d5e8d0, nFileSizeHigh=0x0, nFileSizeLow=0x13763, dwReserved0=0x0, dwReserved1=0x0, cFileName="ajP0XObNv_kd.png", cAlternateFileName="AJP0XO~1.PNG")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be03170, ftCreationTime.dwHighDateTime=0x1d5e895, ftLastAccessTime.dwLowDateTime=0xb0d1ddf0, ftLastAccessTime.dwHighDateTime=0x1d5e600, ftLastWriteTime.dwLowDateTime=0xb0d1ddf0, ftLastWriteTime.dwHighDateTime=0x1d5e600, nFileSizeHigh=0x0, nFileSizeLow=0x1739c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALOYj.png", cAlternateFileName="")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x8b96dd70, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0x8b96dd70, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0Zd", cAlternateFileName="")) returned 1 [0141.877] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0c0530, ftCreationTime.dwHighDateTime=0x1d5e246, ftLastAccessTime.dwLowDateTime=0xc93049e0, ftLastAccessTime.dwHighDateTime=0x1d5e24a, ftLastWriteTime.dwLowDateTime=0xc93049e0, ftLastWriteTime.dwHighDateTime=0x1d5e24a, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bFv5D.jpg", cAlternateFileName="")) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbd07210, ftCreationTime.dwHighDateTime=0x1d5efca, ftLastAccessTime.dwLowDateTime=0xb5f22bd0, ftLastAccessTime.dwHighDateTime=0x1d5e837, ftLastWriteTime.dwLowDateTime=0xb5f22bd0, ftLastWriteTime.dwHighDateTime=0x1d5e837, nFileSizeHigh=0x0, nFileSizeLow=0x2c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="fQx5SEtSbjG_Xd.jpg", cAlternateFileName="FQX5SE~1.JPG")) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa09575d0, ftCreationTime.dwHighDateTime=0x1d5e2e7, ftLastAccessTime.dwLowDateTime=0x1fadcb40, ftLastAccessTime.dwHighDateTime=0x1d5ea7e, ftLastWriteTime.dwLowDateTime=0x1fadcb40, ftLastWriteTime.dwHighDateTime=0x1d5ea7e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ft Ut.gif", cAlternateFileName="FTUT~1.GIF")) returned 1 [0141.878] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c2f40, ftCreationTime.dwHighDateTime=0x1d5ea6f, ftLastAccessTime.dwLowDateTime=0x85449900, ftLastAccessTime.dwHighDateTime=0x1d5e80a, ftLastWriteTime.dwLowDateTime=0x85449900, ftLastWriteTime.dwHighDateTime=0x1d5e80a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="g02_GrvIku5VLUm6A.png", cAlternateFileName="G02_GR~1.PNG")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4156650, ftCreationTime.dwHighDateTime=0x1d5e9c8, ftLastAccessTime.dwLowDateTime=0x5b2edd40, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x5b2edd40, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0xb35, dwReserved0=0x0, dwReserved1=0x0, cFileName="lGSgSxh.png", cAlternateFileName="")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cd4cec0, ftCreationTime.dwHighDateTime=0x1d5eab2, ftLastAccessTime.dwLowDateTime=0x4bcb9610, ftLastAccessTime.dwHighDateTime=0x1d5f0e8, ftLastWriteTime.dwLowDateTime=0x4bcb9610, ftLastWriteTime.dwHighDateTime=0x1d5f0e8, nFileSizeHigh=0x0, nFileSizeLow=0x132ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MzCDKn.gif", cAlternateFileName="")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e20d180, ftCreationTime.dwHighDateTime=0x1d5f043, ftLastAccessTime.dwLowDateTime=0x78b48d70, ftLastAccessTime.dwHighDateTime=0x1d5e0c7, ftLastWriteTime.dwLowDateTime=0x78b48d70, ftLastWriteTime.dwHighDateTime=0x1d5e0c7, nFileSizeHigh=0x0, nFileSizeLow=0x5811, dwReserved0=0x0, dwReserved1=0x0, cFileName="oK0Zcaq.jpg", cAlternateFileName="")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedfdecb0, ftCreationTime.dwHighDateTime=0x1d5e929, ftLastAccessTime.dwLowDateTime=0x4895bb00, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x4895bb00, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0x161d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ou71Z.bmp", cAlternateFileName="")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfe843d0, ftCreationTime.dwHighDateTime=0x1d5e40f, ftLastAccessTime.dwLowDateTime=0xaceb310, ftLastAccessTime.dwHighDateTime=0x1d5e515, ftLastWriteTime.dwLowDateTime=0xaceb310, ftLastWriteTime.dwHighDateTime=0x1d5e515, nFileSizeHigh=0x0, nFileSizeLow=0x2a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="rUJEpUQXIHItPk4CRYU5.png", cAlternateFileName="RUJEPU~1.PNG")) returned 1 [0141.879] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79b16ae0, ftCreationTime.dwHighDateTime=0x1d5e955, ftLastAccessTime.dwLowDateTime=0x11f0a860, ftLastAccessTime.dwHighDateTime=0x1d5e880, ftLastWriteTime.dwLowDateTime=0x11f0a860, ftLastWriteTime.dwHighDateTime=0x1d5e880, nFileSizeHigh=0x0, nFileSizeLow=0x11a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfhIstnkvDxRXKXB3.bmp", cAlternateFileName="SFHIST~1.BMP")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66fc0620, ftCreationTime.dwHighDateTime=0x1d5edd4, ftLastAccessTime.dwLowDateTime=0xad905f60, ftLastAccessTime.dwHighDateTime=0x1d5e680, ftLastWriteTime.dwLowDateTime=0xad905f60, ftLastWriteTime.dwHighDateTime=0x1d5e680, nFileSizeHigh=0x0, nFileSizeLow=0x13bb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEMq1zcwczIu.bmp", cAlternateFileName="TEMQ1Z~1.BMP")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b0db5d0, ftCreationTime.dwHighDateTime=0x1d5eb6d, ftLastAccessTime.dwLowDateTime=0xc55dd4e0, ftLastAccessTime.dwHighDateTime=0x1d5ed5d, ftLastWriteTime.dwLowDateTime=0xc55dd4e0, ftLastWriteTime.dwHighDateTime=0x1d5ed5d, nFileSizeHigh=0x0, nFileSizeLow=0x93ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Un3qj.png", cAlternateFileName="")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50cfd40, ftCreationTime.dwHighDateTime=0x1d5ee43, ftLastAccessTime.dwLowDateTime=0x82950460, ftLastAccessTime.dwHighDateTime=0x1d5ed23, ftLastWriteTime.dwLowDateTime=0x82950460, ftLastWriteTime.dwHighDateTime=0x1d5ed23, nFileSizeHigh=0x0, nFileSizeLow=0x12b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="WBiG1iVen RrT.png", cAlternateFileName="WBIG1I~1.PNG")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630dee30, ftCreationTime.dwHighDateTime=0x1d5e5e0, ftLastAccessTime.dwLowDateTime=0xf04863c0, ftLastAccessTime.dwHighDateTime=0x1d5eecd, ftLastWriteTime.dwLowDateTime=0xf04863c0, ftLastWriteTime.dwHighDateTime=0x1d5eecd, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZ6l-ufacjI UwQqXuT.gif", cAlternateFileName="WZ6L-U~1.GIF")) returned 1 [0141.880] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5c620, ftCreationTime.dwHighDateTime=0x1d5e792, ftLastAccessTime.dwLowDateTime=0x75836050, ftLastAccessTime.dwHighDateTime=0x1d5e1fc, ftLastWriteTime.dwLowDateTime=0x75836050, ftLastWriteTime.dwHighDateTime=0x1d5e1fc, nFileSizeHigh=0x0, nFileSizeLow=0x54ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ym4AyOtD4LU2hVs.gif", cAlternateFileName="YM4AYO~1.GIF")) returned 1 [0141.881] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02056f0, ftCreationTime.dwHighDateTime=0x1d5eadd, ftLastAccessTime.dwLowDateTime=0x36ccbcc0, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x36ccbcc0, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0x174e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_yu8ubor_1hWM.bmp", cAlternateFileName="_YU8UB~1.BMP")) returned 1 [0141.881] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0141.881] FindClose (in: hFindFile=0x76e468 | out: hFindFile=0x76e468) returned 1 [0141.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e888) returned 1 [0141.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e894) returned 1 [0141.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0141.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp.jcrypt", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp.jcrypt", lpFilePart=0x0) returned 0x28 [0141.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0141.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\4m-h.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0141.883] GetFileType (hFile=0x378) returned 0x1 [0141.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0141.883] GetFileType (hFile=0x378) returned 0x1 [0143.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0143.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", lpFilePart=0x0) returned 0x21 [0143.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0143.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4m-h.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0143.610] GetFileType (hFile=0x360) returned 0x1 [0143.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0143.610] GetFileType (hFile=0x360) returned 0x1 [0143.614] ReadFile (in: hFile=0x360, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x9ebc, lpOverlapped=0x0) returned 1 [0143.640] WriteFile (in: hFile=0x378, lpBuffer=0x25386cc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25386cc*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0143.642] WriteFile (in: hFile=0x378, lpBuffer=0x253ab90*, nNumberOfBytesToWrite=0x8ed0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x253ab90*, lpNumberOfBytesWritten=0x55e7d0*=0x8ed0, lpOverlapped=0x0) returned 1 [0143.643] ReadFile (in: hFile=0x360, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0143.643] CloseHandle (hObject=0x360) returned 1 [0143.643] WriteFile (in: hFile=0x378, lpBuffer=0x25386cc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x25386cc*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0143.644] CloseHandle (hObject=0x378) returned 1 [0143.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0143.647] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", nBufferLength=0x22, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp", lpFilePart=0x0) returned 0x21 [0143.647] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4M-h.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4m-h.bmp")) returned 1 [0143.657] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0143.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png.jcrypt", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png.jcrypt", lpFilePart=0x0) returned 0x35 [0143.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0143.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\7z 0lvlaokipdmbcn.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0143.658] GetFileType (hFile=0x378) returned 0x1 [0143.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0143.659] GetFileType (hFile=0x378) returned 0x1 [0145.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0145.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", lpFilePart=0x0) returned 0x2e [0145.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0145.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7z 0lvlaokipdmbcn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0145.625] GetFileType (hFile=0x360) returned 0x1 [0145.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0145.625] GetFileType (hFile=0x360) returned 0x1 [0145.628] ReadFile (in: hFile=0x360, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0xc8fe, lpOverlapped=0x0) returned 1 [0145.653] WriteFile (in: hFile=0x378, lpBuffer=0x2424dc4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2424dc4*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0145.654] WriteFile (in: hFile=0x378, lpBuffer=0x24272a0*, nNumberOfBytesToWrite=0xb910, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24272a0*, lpNumberOfBytesWritten=0x55e7d0*=0xb910, lpOverlapped=0x0) returned 1 [0145.655] ReadFile (in: hFile=0x360, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0145.655] CloseHandle (hObject=0x360) returned 1 [0145.656] WriteFile (in: hFile=0x378, lpBuffer=0x2424dc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2424dc4*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0145.656] CloseHandle (hObject=0x378) returned 1 [0145.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0145.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png", lpFilePart=0x0) returned 0x2e [0145.658] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7Z 0lVLaokIpDMbCn.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7z 0lvlaokipdmbcn.png")) returned 1 [0145.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png.jcrypt", lpFilePart=0x0) returned 0x30 [0145.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0145.666] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\ajp0xobnv_kd.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0145.666] GetFileType (hFile=0x378) returned 0x1 [0145.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0145.667] GetFileType (hFile=0x378) returned 0x1 [0148.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0148.049] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", lpFilePart=0x0) returned 0x29 [0148.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0148.049] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ajp0xobnv_kd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0148.049] GetFileType (hFile=0x360) returned 0x1 [0148.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0148.049] GetFileType (hFile=0x360) returned 0x1 [0148.054] ReadFile (in: hFile=0x360, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x13763, lpOverlapped=0x0) returned 1 [0148.071] WriteFile (in: hFile=0x378, lpBuffer=0x251587c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x251587c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0148.072] WriteFile (in: hFile=0x378, lpBuffer=0x2517d50*, nNumberOfBytesToWrite=0x12780, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2517d50*, lpNumberOfBytesWritten=0x55e7d0*=0x12780, lpOverlapped=0x0) returned 1 [0148.074] ReadFile (in: hFile=0x360, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0148.074] CloseHandle (hObject=0x360) returned 1 [0148.074] WriteFile (in: hFile=0x378, lpBuffer=0x251587c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x251587c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0148.074] CloseHandle (hObject=0x378) returned 1 [0148.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0148.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png", lpFilePart=0x0) returned 0x29 [0148.078] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ajP0XObNv_kd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ajp0xobnv_kd.png")) returned 1 [0148.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0148.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png.jcrypt", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png.jcrypt", lpFilePart=0x0) returned 0x29 [0148.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0148.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\aloyj.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0148.082] GetFileType (hFile=0x378) returned 0x1 [0148.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0148.082] GetFileType (hFile=0x378) returned 0x1 [0151.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0151.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", lpFilePart=0x0) returned 0x22 [0151.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0151.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\aloyj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0151.159] GetFileType (hFile=0x3f4) returned 0x1 [0151.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0151.159] GetFileType (hFile=0x3f4) returned 0x1 [0151.164] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x1739c, lpOverlapped=0x0) returned 1 [0151.182] WriteFile (in: hFile=0x378, lpBuffer=0x240e94c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x240e94c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0151.184] WriteFile (in: hFile=0x378, lpBuffer=0x35a1560*, nNumberOfBytesToWrite=0x163b0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x35a1560*, lpNumberOfBytesWritten=0x55e7d0*=0x163b0, lpOverlapped=0x0) returned 1 [0151.186] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0151.186] CloseHandle (hObject=0x3f4) returned 1 [0151.186] WriteFile (in: hFile=0x378, lpBuffer=0x240e94c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x240e94c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0151.186] CloseHandle (hObject=0x378) returned 1 [0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png", lpFilePart=0x0) returned 0x22 [0151.256] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ALOYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\aloyj.png")) returned 1 [0151.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0151.305] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg.jcrypt", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg.jcrypt", lpFilePart=0x0) returned 0x29 [0151.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0151.305] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\bfv5d.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0151.305] GetFileType (hFile=0x378) returned 0x1 [0151.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0151.305] GetFileType (hFile=0x378) returned 0x1 [0154.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0154.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", lpFilePart=0x0) returned 0x22 [0154.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0154.008] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bfv5d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0154.008] GetFileType (hFile=0x3f4) returned 0x1 [0154.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0154.008] GetFileType (hFile=0x3f4) returned 0x1 [0154.011] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b7930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b7930*, lpNumberOfBytesRead=0x55e7f8*=0x99c, lpOverlapped=0x0) returned 1 [0154.109] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b7930, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b7930*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0154.109] CloseHandle (hObject=0x3f4) returned 1 [0154.110] WriteFile (in: hFile=0x378, lpBuffer=0x24f11f0*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24f11f0*, lpNumberOfBytesWritten=0x55e798*=0x9c0, lpOverlapped=0x0) returned 1 [0154.111] CloseHandle (hObject=0x378) returned 1 [0154.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0154.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg", lpFilePart=0x0) returned 0x22 [0154.112] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bFv5D.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bfv5d.jpg")) returned 1 [0154.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0154.115] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.jcrypt", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x2b [0154.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0154.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0154.115] GetFileType (hFile=0x378) returned 0x1 [0154.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0154.115] GetFileType (hFile=0x378) returned 0x1 [0156.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0156.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0156.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0156.866] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0156.866] GetFileType (hFile=0x3f4) returned 0x1 [0156.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0156.866] GetFileType (hFile=0x3f4) returned 0x1 [0156.869] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b7950, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b7950*, lpNumberOfBytesRead=0x55e7f8*=0x1f8, lpOverlapped=0x0) returned 1 [0156.880] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b7950, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b7950*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0156.880] CloseHandle (hObject=0x3f4) returned 1 [0156.880] WriteFile (in: hFile=0x378, lpBuffer=0x23d44a0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23d44a0*, lpNumberOfBytesWritten=0x55e798*=0x220, lpOverlapped=0x0) returned 1 [0156.881] CloseHandle (hObject=0x378) returned 1 [0156.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0156.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x24 [0156.882] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini")) returned 1 [0156.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0156.884] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg.jcrypt", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg.jcrypt", lpFilePart=0x0) returned 0x32 [0156.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0156.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\fqx5setsbjg_xd.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0156.884] GetFileType (hFile=0x378) returned 0x1 [0156.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0156.885] GetFileType (hFile=0x378) returned 0x1 [0159.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0159.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", lpFilePart=0x0) returned 0x2b [0159.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0159.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fqx5setsbjg_xd.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0159.623] GetFileType (hFile=0x3f4) returned 0x1 [0159.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0159.623] GetFileType (hFile=0x3f4) returned 0x1 [0159.627] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x2c08, lpOverlapped=0x0) returned 1 [0159.688] WriteFile (in: hFile=0x378, lpBuffer=0x24b7bd0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24b7bd0*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0159.690] WriteFile (in: hFile=0x378, lpBuffer=0x24ba0a8*, nNumberOfBytesToWrite=0x1c20, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24ba0a8*, lpNumberOfBytesWritten=0x55e7d0*=0x1c20, lpOverlapped=0x0) returned 1 [0159.690] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0159.691] CloseHandle (hObject=0x3f4) returned 1 [0159.691] WriteFile (in: hFile=0x378, lpBuffer=0x24b7bd0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24b7bd0*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0159.691] CloseHandle (hObject=0x378) returned 1 [0159.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0159.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg", lpFilePart=0x0) returned 0x2b [0159.694] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fQx5SEtSbjG_Xd.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\fqx5setsbjg_xd.jpg")) returned 1 [0159.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0159.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif.jcrypt", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif.jcrypt", lpFilePart=0x0) returned 0x29 [0159.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0159.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\ft ut.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0159.732] GetFileType (hFile=0x378) returned 0x1 [0159.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0159.732] GetFileType (hFile=0x378) returned 0x1 [0161.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0161.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", lpFilePart=0x0) returned 0x22 [0161.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0161.935] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ft ut.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0161.935] GetFileType (hFile=0x3f4) returned 0x1 [0161.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0161.935] GetFileType (hFile=0x3f4) returned 0x1 [0161.937] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x7b1b, lpOverlapped=0x0) returned 1 [0162.008] WriteFile (in: hFile=0x378, lpBuffer=0x239d240*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x239d240*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0162.017] WriteFile (in: hFile=0x378, lpBuffer=0x239f704*, nNumberOfBytesToWrite=0x6b30, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x239f704*, lpNumberOfBytesWritten=0x55e7d0*=0x6b30, lpOverlapped=0x0) returned 1 [0162.018] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0162.018] CloseHandle (hObject=0x3f4) returned 1 [0162.018] WriteFile (in: hFile=0x378, lpBuffer=0x239d240*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x239d240*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0162.018] CloseHandle (hObject=0x378) returned 1 [0162.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0162.020] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif", lpFilePart=0x0) returned 0x22 [0162.021] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ft Ut.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ft ut.gif")) returned 1 [0162.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0162.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png.jcrypt", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png.jcrypt", lpFilePart=0x0) returned 0x35 [0162.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0162.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\g02_grviku5vlum6a.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0162.075] GetFileType (hFile=0x378) returned 0x1 [0162.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0162.075] GetFileType (hFile=0x378) returned 0x1 [0165.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0165.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", lpFilePart=0x0) returned 0x2e [0165.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0165.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png" (normalized: "c:\\users\\fd1hvy\\pictures\\g02_grviku5vlum6a.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0165.178] GetFileType (hFile=0x3f4) returned 0x1 [0165.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0165.178] GetFileType (hFile=0x3f4) returned 0x1 [0165.182] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x9fc8, lpOverlapped=0x0) returned 1 [0165.198] WriteFile (in: hFile=0x378, lpBuffer=0x248926c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x248926c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0165.199] WriteFile (in: hFile=0x378, lpBuffer=0x248b748*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x248b748*, lpNumberOfBytesWritten=0x55e7d0*=0x8fe0, lpOverlapped=0x0) returned 1 [0165.200] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0165.200] CloseHandle (hObject=0x3f4) returned 1 [0165.200] WriteFile (in: hFile=0x378, lpBuffer=0x248926c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x248926c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0165.201] CloseHandle (hObject=0x378) returned 1 [0165.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0165.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png", lpFilePart=0x0) returned 0x2e [0165.203] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\g02_GrvIku5VLUm6A.png" (normalized: "c:\\users\\fd1hvy\\pictures\\g02_grviku5vlum6a.png")) returned 1 [0165.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0165.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png.jcrypt", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png.jcrypt", lpFilePart=0x0) returned 0x2b [0165.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0165.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\lgsgsxh.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0165.247] GetFileType (hFile=0x378) returned 0x1 [0165.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0165.247] GetFileType (hFile=0x378) returned 0x1 [0168.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0168.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", lpFilePart=0x0) returned 0x24 [0168.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0168.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lgsgsxh.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0168.208] GetFileType (hFile=0x3f4) returned 0x1 [0168.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0168.208] GetFileType (hFile=0x3f4) returned 0x1 [0168.212] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xb35, lpOverlapped=0x0) returned 1 [0168.289] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0168.289] CloseHandle (hObject=0x3f4) returned 1 [0168.289] WriteFile (in: hFile=0x378, lpBuffer=0x25759ec*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x25759ec*, lpNumberOfBytesWritten=0x55e798*=0xb60, lpOverlapped=0x0) returned 1 [0168.290] CloseHandle (hObject=0x378) returned 1 [0168.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0168.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png", lpFilePart=0x0) returned 0x24 [0168.409] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\lGSgSxh.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lgsgsxh.png")) returned 1 [0168.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0168.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif.jcrypt", lpFilePart=0x0) returned 0x2a [0168.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0168.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\mzcdkn.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0168.412] GetFileType (hFile=0x378) returned 0x1 [0168.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0168.412] GetFileType (hFile=0x378) returned 0x1 [0170.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0170.982] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", lpFilePart=0x0) returned 0x23 [0170.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0170.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mzcdkn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0170.983] GetFileType (hFile=0x3f4) returned 0x1 [0170.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0170.983] GetFileType (hFile=0x3f4) returned 0x1 [0170.987] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x132ae, lpOverlapped=0x0) returned 1 [0171.075] WriteFile (in: hFile=0x378, lpBuffer=0x2459020*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2459020*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0171.077] WriteFile (in: hFile=0x378, lpBuffer=0x245b4e8*, nNumberOfBytesToWrite=0x122c0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x245b4e8*, lpNumberOfBytesWritten=0x55e7d0*=0x122c0, lpOverlapped=0x0) returned 1 [0171.079] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0171.079] CloseHandle (hObject=0x3f4) returned 1 [0171.079] WriteFile (in: hFile=0x378, lpBuffer=0x2459020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2459020*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0171.079] CloseHandle (hObject=0x378) returned 1 [0171.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0171.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif", lpFilePart=0x0) returned 0x23 [0171.085] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MzCDKn.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mzcdkn.gif")) returned 1 [0171.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0171.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg.jcrypt", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg.jcrypt", lpFilePart=0x0) returned 0x2b [0171.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0171.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\ok0zcaq.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0171.283] GetFileType (hFile=0x378) returned 0x1 [0171.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0171.283] GetFileType (hFile=0x378) returned 0x1 [0173.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0173.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", lpFilePart=0x0) returned 0x24 [0173.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0173.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ok0zcaq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0173.877] GetFileType (hFile=0x3f4) returned 0x1 [0173.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0173.877] GetFileType (hFile=0x3f4) returned 0x1 [0173.881] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x5811, lpOverlapped=0x0) returned 1 [0173.897] WriteFile (in: hFile=0x378, lpBuffer=0x254ee24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x254ee24*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0173.899] WriteFile (in: hFile=0x378, lpBuffer=0x25512ec*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25512ec*, lpNumberOfBytesWritten=0x55e7d0*=0x4830, lpOverlapped=0x0) returned 1 [0173.899] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0173.899] CloseHandle (hObject=0x3f4) returned 1 [0173.900] WriteFile (in: hFile=0x378, lpBuffer=0x254ee24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x254ee24*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0173.900] CloseHandle (hObject=0x378) returned 1 [0173.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0173.902] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg", lpFilePart=0x0) returned 0x24 [0173.902] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\oK0Zcaq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ok0zcaq.jpg")) returned 1 [0173.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0173.917] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp.jcrypt", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp.jcrypt", lpFilePart=0x0) returned 0x29 [0173.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0173.917] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\ou71z.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0173.917] GetFileType (hFile=0x378) returned 0x1 [0173.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0173.917] GetFileType (hFile=0x378) returned 0x1 [0175.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0175.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", lpFilePart=0x0) returned 0x22 [0175.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0175.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ou71z.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0175.219] GetFileType (hFile=0x3f4) returned 0x1 [0175.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0175.219] GetFileType (hFile=0x3f4) returned 0x1 [0175.232] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x161d4, lpOverlapped=0x0) returned 1 [0175.253] WriteFile (in: hFile=0x378, lpBuffer=0x2437a10*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2437a10*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0175.255] WriteFile (in: hFile=0x378, lpBuffer=0x35a1560*, nNumberOfBytesToWrite=0x151f0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x35a1560*, lpNumberOfBytesWritten=0x55e7d0*=0x151f0, lpOverlapped=0x0) returned 1 [0175.257] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0175.257] CloseHandle (hObject=0x3f4) returned 1 [0175.257] WriteFile (in: hFile=0x378, lpBuffer=0x2437a10*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2437a10*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0175.257] CloseHandle (hObject=0x378) returned 1 [0175.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0175.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp", lpFilePart=0x0) returned 0x22 [0175.261] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ou71Z.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\ou71z.bmp")) returned 1 [0175.264] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0175.264] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png.jcrypt", nBufferLength=0x39, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png.jcrypt", lpFilePart=0x0) returned 0x38 [0175.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0175.264] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\rujepuqxihitpk4cryu5.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0175.265] GetFileType (hFile=0x378) returned 0x1 [0175.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0175.265] GetFileType (hFile=0x378) returned 0x1 [0176.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0176.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", lpFilePart=0x0) returned 0x31 [0176.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0176.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rujepuqxihitpk4cryu5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0176.325] GetFileType (hFile=0x3f4) returned 0x1 [0176.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0176.325] GetFileType (hFile=0x3f4) returned 0x1 [0176.328] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b6770, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b6770*, lpNumberOfBytesRead=0x55e7f8*=0x2a63, lpOverlapped=0x0) returned 1 [0176.340] WriteFile (in: hFile=0x378, lpBuffer=0x251a660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x251a660*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0176.341] WriteFile (in: hFile=0x378, lpBuffer=0x251cb44*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x251cb44*, lpNumberOfBytesWritten=0x55e7d0*=0x1a80, lpOverlapped=0x0) returned 1 [0176.341] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b6770, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b6770*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0176.341] CloseHandle (hObject=0x3f4) returned 1 [0176.341] WriteFile (in: hFile=0x378, lpBuffer=0x251a660*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x251a660*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0176.342] CloseHandle (hObject=0x378) returned 1 [0176.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0176.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png", lpFilePart=0x0) returned 0x31 [0176.343] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rUJEpUQXIHItPk4CRYU5.png" (normalized: "c:\\users\\fd1hvy\\pictures\\rujepuqxihitpk4cryu5.png")) returned 1 [0176.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0176.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp.jcrypt", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp.jcrypt", lpFilePart=0x0) returned 0x35 [0176.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0176.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\sfhistnkvdxrxkxb3.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0176.345] GetFileType (hFile=0x378) returned 0x1 [0176.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0176.345] GetFileType (hFile=0x378) returned 0x1 [0177.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0177.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", lpFilePart=0x0) returned 0x2e [0177.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0177.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sfhistnkvdxrxkxb3.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0177.841] GetFileType (hFile=0x3f4) returned 0x1 [0177.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0177.841] GetFileType (hFile=0x3f4) returned 0x1 [0177.845] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b6790, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b6790*, lpNumberOfBytesRead=0x55e7f8*=0x11a74, lpOverlapped=0x0) returned 1 [0177.860] WriteFile (in: hFile=0x378, lpBuffer=0x23ffd90*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23ffd90*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0177.863] WriteFile (in: hFile=0x378, lpBuffer=0x240226c*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x240226c*, lpNumberOfBytesWritten=0x55e7d0*=0x10a90, lpOverlapped=0x0) returned 1 [0177.864] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b6790, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b6790*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0177.864] CloseHandle (hObject=0x3f4) returned 1 [0177.864] WriteFile (in: hFile=0x378, lpBuffer=0x23ffd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23ffd90*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0177.864] CloseHandle (hObject=0x378) returned 1 [0177.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0177.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp", lpFilePart=0x0) returned 0x2e [0177.867] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\SfhIstnkvDxRXKXB3.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\sfhistnkvdxrxkxb3.bmp")) returned 1 [0177.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp.jcrypt", lpFilePart=0x0) returned 0x30 [0177.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0177.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\temq1zcwcziu.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0177.869] GetFileType (hFile=0x378) returned 0x1 [0177.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0177.869] GetFileType (hFile=0x378) returned 0x1 [0179.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0179.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", lpFilePart=0x0) returned 0x29 [0179.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0179.513] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\temq1zcwcziu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0179.513] GetFileType (hFile=0x3f4) returned 0x1 [0179.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0179.513] GetFileType (hFile=0x3f4) returned 0x1 [0179.517] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x13bb5, lpOverlapped=0x0) returned 1 [0179.535] WriteFile (in: hFile=0x378, lpBuffer=0x24f60dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24f60dc*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0179.537] WriteFile (in: hFile=0x378, lpBuffer=0x24f85b0*, nNumberOfBytesToWrite=0x12bd0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24f85b0*, lpNumberOfBytesWritten=0x55e7d0*=0x12bd0, lpOverlapped=0x0) returned 1 [0179.538] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0179.539] CloseHandle (hObject=0x3f4) returned 1 [0179.539] WriteFile (in: hFile=0x378, lpBuffer=0x24f60dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24f60dc*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0179.539] CloseHandle (hObject=0x378) returned 1 [0179.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0179.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp", lpFilePart=0x0) returned 0x29 [0179.545] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TEMq1zcwczIu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\temq1zcwcziu.bmp")) returned 1 [0179.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0179.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png.jcrypt", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png.jcrypt", lpFilePart=0x0) returned 0x29 [0179.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0179.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\un3qj.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0179.561] GetFileType (hFile=0x378) returned 0x1 [0179.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0179.561] GetFileType (hFile=0x378) returned 0x1 [0180.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0180.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", lpFilePart=0x0) returned 0x22 [0180.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0180.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\un3qj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0180.930] GetFileType (hFile=0x3f4) returned 0x1 [0180.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0180.930] GetFileType (hFile=0x3f4) returned 0x1 [0180.932] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x93ef, lpOverlapped=0x0) returned 1 [0180.946] WriteFile (in: hFile=0x378, lpBuffer=0x23ec954*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23ec954*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0180.947] WriteFile (in: hFile=0x378, lpBuffer=0x23eee18*, nNumberOfBytesToWrite=0x8400, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23eee18*, lpNumberOfBytesWritten=0x55e7d0*=0x8400, lpOverlapped=0x0) returned 1 [0180.947] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0180.947] CloseHandle (hObject=0x3f4) returned 1 [0180.948] WriteFile (in: hFile=0x378, lpBuffer=0x23ec954*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23ec954*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0180.948] CloseHandle (hObject=0x378) returned 1 [0180.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0180.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png", lpFilePart=0x0) returned 0x22 [0180.953] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Un3qj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\un3qj.png")) returned 1 [0180.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0180.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png.jcrypt", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png.jcrypt", lpFilePart=0x0) returned 0x31 [0180.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0180.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\wbig1iven rrt.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0180.969] GetFileType (hFile=0x378) returned 0x1 [0180.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0180.969] GetFileType (hFile=0x378) returned 0x1 [0182.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0182.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", lpFilePart=0x0) returned 0x2a [0182.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0182.137] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png" (normalized: "c:\\users\\fd1hvy\\pictures\\wbig1iven rrt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0182.138] GetFileType (hFile=0x3f4) returned 0x1 [0182.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0182.138] GetFileType (hFile=0x3f4) returned 0x1 [0182.140] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x12b50, lpOverlapped=0x0) returned 1 [0182.154] WriteFile (in: hFile=0x378, lpBuffer=0x24d8aa0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24d8aa0*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0182.156] WriteFile (in: hFile=0x378, lpBuffer=0x24daf74*, nNumberOfBytesToWrite=0x11b70, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24daf74*, lpNumberOfBytesWritten=0x55e7d0*=0x11b70, lpOverlapped=0x0) returned 1 [0182.157] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0182.158] CloseHandle (hObject=0x3f4) returned 1 [0182.158] WriteFile (in: hFile=0x378, lpBuffer=0x24d8aa0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24d8aa0*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0182.158] CloseHandle (hObject=0x378) returned 1 [0182.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0182.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png", lpFilePart=0x0) returned 0x2a [0182.163] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WBiG1iVen RrT.png" (normalized: "c:\\users\\fd1hvy\\pictures\\wbig1iven rrt.png")) returned 1 [0182.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0182.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif.jcrypt", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif.jcrypt", lpFilePart=0x0) returned 0x37 [0182.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0182.191] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\wz6l-ufacji uwqqxut.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0182.191] GetFileType (hFile=0x378) returned 0x1 [0182.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0182.191] GetFileType (hFile=0x378) returned 0x1 [0183.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0183.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", lpFilePart=0x0) returned 0x30 [0183.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0183.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wz6l-ufacji uwqqxut.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0183.996] GetFileType (hFile=0x3f4) returned 0x1 [0183.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0183.996] GetFileType (hFile=0x3f4) returned 0x1 [0184.000] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xe3c8, lpOverlapped=0x0) returned 1 [0184.015] WriteFile (in: hFile=0x378, lpBuffer=0x23ceac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23ceac8*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0184.016] WriteFile (in: hFile=0x378, lpBuffer=0x23d0fa8*, nNumberOfBytesToWrite=0xd3e0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23d0fa8*, lpNumberOfBytesWritten=0x55e7d0*=0xd3e0, lpOverlapped=0x0) returned 1 [0184.018] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0184.018] CloseHandle (hObject=0x3f4) returned 1 [0184.018] WriteFile (in: hFile=0x378, lpBuffer=0x23ceac8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23ceac8*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0184.018] CloseHandle (hObject=0x378) returned 1 [0184.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0184.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif", lpFilePart=0x0) returned 0x30 [0184.024] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WZ6l-ufacjI UwQqXuT.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\wz6l-ufacji uwqqxut.gif")) returned 1 [0184.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0184.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif.jcrypt", lpFilePart=0x0) returned 0x33 [0184.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0184.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\ym4ayotd4lu2hvs.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0184.043] GetFileType (hFile=0x378) returned 0x1 [0184.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0184.044] GetFileType (hFile=0x378) returned 0x1 [0185.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0185.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", lpFilePart=0x0) returned 0x2c [0185.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0185.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ym4ayotd4lu2hvs.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0185.599] GetFileType (hFile=0x3f4) returned 0x1 [0185.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0185.599] GetFileType (hFile=0x3f4) returned 0x1 [0185.603] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x54ac, lpOverlapped=0x0) returned 1 [0185.620] WriteFile (in: hFile=0x378, lpBuffer=0x24bfcd8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24bfcd8*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0185.622] WriteFile (in: hFile=0x378, lpBuffer=0x24c21b0*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24c21b0*, lpNumberOfBytesWritten=0x55e7d0*=0x44c0, lpOverlapped=0x0) returned 1 [0185.622] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0185.622] CloseHandle (hObject=0x3f4) returned 1 [0185.623] WriteFile (in: hFile=0x378, lpBuffer=0x24bfcd8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24bfcd8*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0185.623] CloseHandle (hObject=0x378) returned 1 [0185.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0185.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif", lpFilePart=0x0) returned 0x2c [0185.625] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ym4AyOtD4LU2hVs.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\ym4ayotd4lu2hvs.gif")) returned 1 [0185.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0185.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp.jcrypt", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp.jcrypt", lpFilePart=0x0) returned 0x31 [0185.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0185.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\_yu8ubor_1hwm.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0185.641] GetFileType (hFile=0x378) returned 0x1 [0185.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0185.641] GetFileType (hFile=0x378) returned 0x1 [0187.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0187.871] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", lpFilePart=0x0) returned 0x2a [0187.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0187.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\_yu8ubor_1hwm.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0187.871] GetFileType (hFile=0x3f4) returned 0x1 [0187.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0187.872] GetFileType (hFile=0x3f4) returned 0x1 [0187.875] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x174e4, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x378, lpBuffer=0x23a7fe4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23a7fe4*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0188.111] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x16500, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e7d0*=0x16500, lpOverlapped=0x0) returned 1 [0188.113] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0188.125] CloseHandle (hObject=0x3f4) returned 1 [0188.125] WriteFile (in: hFile=0x378, lpBuffer=0x23a7fe4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23a7fe4*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0188.126] CloseHandle (hObject=0x378) returned 1 [0188.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0188.137] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp", lpFilePart=0x0) returned 0x2a [0188.160] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_yu8ubor_1hWM.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\_yu8ubor_1hwm.bmp")) returned 1 [0188.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e8cc) returned 1 [0188.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0188.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0188.178] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x55e5f4 | out: lpFindFileData=0x55e5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf97a8615, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xff9ff9a0, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dee8 [0188.179] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf97a8615, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xff9ff9a0, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.179] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe40822db, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xe40822db, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xe514e611, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x9ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4M-h.bmp.jcrypt", cAlternateFileName="4M-HBM~1.JCR")) returned 1 [0188.179] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe517481b, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xe517481b, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xe6471a25, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0xc920, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Z 0lVLaokIpDMbCn.png.jcrypt", cAlternateFileName="7Z0LVL~1.JCR")) returned 1 [0188.179] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6497b78, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xe6497b78, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xe7b8818c, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x13790, dwReserved0=0x0, dwReserved1=0x0, cFileName="ajP0XObNv_kd.png.jcrypt", cAlternateFileName="AJP0XO~1.JCR")) returned 1 [0188.179] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b8818c, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xe7b8818c, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xe99ee231, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x173c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALOYj.png.jcrypt", cAlternateFileName="ALOYJP~1.JCR")) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x8b96dd70, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0x8b96dd70, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B0Zd", cAlternateFileName="")) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9a60992, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xe9a60992, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xeb50aaec, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bFv5D.jpg.jcrypt", cAlternateFileName="BFV5DJ~1.JCR")) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb530d8f, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xeb530d8f, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xecf90d76, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 1 [0188.180] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf90d76, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xecf90d76, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xeea4a0b0, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x2c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="fQx5SEtSbjG_Xd.jpg.jcrypt", cAlternateFileName="FQX5SE~1.JCR")) returned 1 [0188.181] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeabc76e, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xeeabc76e, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf007e0dd, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x7b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ft Ut.gif.jcrypt", cAlternateFileName="FTUTGI~1.JCR")) returned 1 [0188.181] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf011687a, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf011687a, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf1ee51fc, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x9ff0, dwReserved0=0x0, dwReserved1=0x0, cFileName="g02_GrvIku5VLUm6A.png.jcrypt", cAlternateFileName="G02_GR~1.JCR")) returned 1 [0188.181] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f57904, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf1f57904, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf3d54bed, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="lGSgSxh.png.jcrypt", cAlternateFileName="LGSGSX~1.JCR")) returned 1 [0188.181] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d85ec6, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf3d85ec6, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf56f14c1, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x132d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MzCDKn.gif.jcrypt", cAlternateFileName="MZCDKN~1.JCR")) returned 1 [0188.181] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58e1693, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf58e1693, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf71d7e11, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x5840, dwReserved0=0x0, dwReserved1=0x0, cFileName="oK0Zcaq.jpg.jcrypt", cAlternateFileName="OK0ZCA~1.JCR")) returned 1 [0188.182] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf71fdf5a, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf71fdf5a, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf7ecea7b, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x16200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ou71Z.bmp.jcrypt", cAlternateFileName="OU71ZB~1.JCR")) returned 1 [0188.182] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7ecea7b, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf7ecea7b, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf8916cbc, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x2a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rUJEpUQXIHItPk4CRYU5.png.jcrypt", cAlternateFileName="RUJEPU~1.JCR")) returned 1 [0188.182] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0188.182] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8916cbc, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf8916cbc, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xf97a8615, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x11aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfhIstnkvDxRXKXB3.bmp.jcrypt", cAlternateFileName="SFHIST~1.JCR")) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97a8615, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xf97a8615, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xfa79a325, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x13be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEMq1zcwczIu.bmp.jcrypt", cAlternateFileName="TEMQ1Z~1.JCR")) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa7c055c, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfa7c055c, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xfb50363e, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x9410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Un3qj.png.jcrypt", cAlternateFileName="UN3QJP~1.JCR")) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb54fa3c, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfb54fa3c, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xfc0a2d25, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x12b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="WBiG1iVen RrT.png.jcrypt", cAlternateFileName="WBIG1I~1.JCR")) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0ef09a, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfc0ef09a, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xfd26a700, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0xe3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZ6l-ufacjI UwQqXuT.gif.jcrypt", cAlternateFileName="WZ6L-U~1.JCR")) returned 1 [0188.183] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd28fdd3, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfd28fdd3, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xfe19cc6d, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x54d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ym4AyOtD4LU2hVs.gif.jcrypt", cAlternateFileName="YM4AYO~1.JCR")) returned 1 [0188.184] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1c2ff9, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfe1c2ff9, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xff98f136, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x17510, dwReserved0=0x0, dwReserved1=0x0, cFileName="_yu8ubor_1hWM.bmp.jcrypt", cAlternateFileName="_YU8UB~1.JCR")) returned 1 [0188.184] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1c2ff9, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xfe1c2ff9, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xff98f136, ftLastWriteTime.dwHighDateTime=0x1d6d767, nFileSizeHigh=0x0, nFileSizeLow=0x17510, dwReserved0=0x0, dwReserved1=0x0, cFileName="_yu8ubor_1hWM.bmp.jcrypt", cAlternateFileName="_YU8UB~1.JCR")) returned 0 [0188.197] FindClose (in: hFindFile=0x76dee8 | out: hFindFile=0x76dee8) returned 1 [0188.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e888) returned 1 [0188.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e894) returned 1 [0188.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0188.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0188.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd", nBufferLength=0x1e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd", lpFilePart=0x0) returned 0x1d [0188.200] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x8b96dd70, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0x8b96dd70, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dee8 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x8b96dd70, ftLastAccessTime.dwHighDateTime=0x1d5e47e, ftLastWriteTime.dwLowDateTime=0x8b96dd70, ftLastWriteTime.dwHighDateTime=0x1d5e47e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb362f500, ftCreationTime.dwHighDateTime=0x1d5e8b1, ftLastAccessTime.dwLowDateTime=0xa734ce60, ftLastAccessTime.dwHighDateTime=0x1d5e957, ftLastWriteTime.dwLowDateTime=0xa734ce60, ftLastWriteTime.dwHighDateTime=0x1d5e957, nFileSizeHigh=0x0, nFileSizeLow=0x3512, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Ez8l2YWj9H2Ap_.png", cAlternateFileName="9EZ8L2~1.PNG")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a686db0, ftCreationTime.dwHighDateTime=0x1d5e779, ftLastAccessTime.dwLowDateTime=0xcdbba820, ftLastAccessTime.dwHighDateTime=0x1d5e27b, ftLastWriteTime.dwLowDateTime=0xcdbba820, ftLastWriteTime.dwHighDateTime=0x1d5e27b, nFileSizeHigh=0x0, nFileSizeLow=0x7167, dwReserved0=0x0, dwReserved1=0x0, cFileName="g TQCzcEK.gif", cAlternateFileName="GTQCZC~1.GIF")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0949940, ftCreationTime.dwHighDateTime=0x1d5ee5d, ftLastAccessTime.dwLowDateTime=0xa827b000, ftLastAccessTime.dwHighDateTime=0x1d5e0ea, ftLastWriteTime.dwLowDateTime=0xa827b000, ftLastWriteTime.dwHighDateTime=0x1d5e0ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhhs6d_oyhmZHDXHD4D.jpg", cAlternateFileName="MHHS6D~1.JPG")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42420660, ftCreationTime.dwHighDateTime=0x1d5e508, ftLastAccessTime.dwLowDateTime=0x80a27500, ftLastAccessTime.dwHighDateTime=0x1d5e645, ftLastWriteTime.dwLowDateTime=0x80a27500, ftLastWriteTime.dwHighDateTime=0x1d5e645, nFileSizeHigh=0x0, nFileSizeLow=0x6ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFEXwxsvTFrnNxmB.jpg", cAlternateFileName="NFEXWX~1.JPG")) returned 1 [0188.201] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe835c0, ftCreationTime.dwHighDateTime=0x1d5ecb6, ftLastAccessTime.dwLowDateTime=0x8686c810, ftLastAccessTime.dwHighDateTime=0x1d5e82d, ftLastWriteTime.dwLowDateTime=0x8686c810, ftLastWriteTime.dwHighDateTime=0x1d5e82d, nFileSizeHigh=0x0, nFileSizeLow=0x66c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeOTIWfGxG0.gif", cAlternateFileName="PEOTIW~1.GIF")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf1abaf0, ftCreationTime.dwHighDateTime=0x1d5ec97, ftLastAccessTime.dwLowDateTime=0x4b186780, ftLastAccessTime.dwHighDateTime=0x1d5eecb, ftLastWriteTime.dwLowDateTime=0x4b186780, ftLastWriteTime.dwHighDateTime=0x1d5eecb, nFileSizeHigh=0x0, nFileSizeLow=0x1bfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmC02kFDILUQuzmf2.bmp", cAlternateFileName="PMC02K~1.BMP")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480ecfd0, ftCreationTime.dwHighDateTime=0x1d5eeb1, ftLastAccessTime.dwLowDateTime=0x67ec5750, ftLastAccessTime.dwHighDateTime=0x1d5ee89, ftLastWriteTime.dwLowDateTime=0x67ec5750, ftLastWriteTime.dwHighDateTime=0x1d5ee89, nFileSizeHigh=0x0, nFileSizeLow=0x11086, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrWLdnhAjVLLnMll.bmp", cAlternateFileName="TRWLDN~1.BMP")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa672220, ftCreationTime.dwHighDateTime=0x1d5e5b2, ftLastAccessTime.dwLowDateTime=0x174076e0, ftLastAccessTime.dwHighDateTime=0x1d5e7e7, ftLastWriteTime.dwLowDateTime=0x174076e0, ftLastWriteTime.dwHighDateTime=0x1d5e7e7, nFileSizeHigh=0x0, nFileSizeLow=0x12883, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7ygSWnKW2.bmp", cAlternateFileName="W7YGSW~1.BMP")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d3cb70, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x6469cd30, ftLastAccessTime.dwHighDateTime=0x1d5e4fa, ftLastWriteTime.dwLowDateTime=0x6469cd30, ftLastWriteTime.dwHighDateTime=0x1d5e4fa, nFileSizeHigh=0x0, nFileSizeLow=0x2f39, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZ9yPnB0.jpg", cAlternateFileName="")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c5169c0, ftCreationTime.dwHighDateTime=0x1d5f037, ftLastAccessTime.dwLowDateTime=0xe9ad1760, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0xe9ad1760, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x131ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="xTWFi5Z02m.png", cAlternateFileName="XTWFI5~1.PNG")) returned 1 [0188.202] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285362f0, ftCreationTime.dwHighDateTime=0x1d5e80d, ftLastAccessTime.dwLowDateTime=0x9c4d8ed0, ftLastAccessTime.dwHighDateTime=0x1d5ee5f, ftLastWriteTime.dwLowDateTime=0x9c4d8ed0, ftLastWriteTime.dwHighDateTime=0x1d5ee5f, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="yVagKL85d9TybhDvL.jpg", cAlternateFileName="YVAGKL~1.JPG")) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf35cd3b0, ftCreationTime.dwHighDateTime=0x1d5e26c, ftLastAccessTime.dwLowDateTime=0x9a6230a0, ftLastAccessTime.dwHighDateTime=0x1d5e6ab, ftLastWriteTime.dwLowDateTime=0x9a6230a0, ftLastWriteTime.dwHighDateTime=0x1d5e6ab, nFileSizeHigh=0x0, nFileSizeLow=0xe874, dwReserved0=0x0, dwReserved1=0x0, cFileName="zv435yj.jpg", cAlternateFileName="")) returned 1 [0188.203] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0188.203] FindClose (in: hFindFile=0x76dee8 | out: hFindFile=0x76dee8) returned 1 [0188.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0188.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0188.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0188.204] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png.jcrypt", nBufferLength=0x39, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png.jcrypt", lpFilePart=0x0) returned 0x38 [0188.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0188.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\9ez8l2ywj9h2ap_.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0188.205] GetFileType (hFile=0x378) returned 0x1 [0188.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0188.205] GetFileType (hFile=0x378) returned 0x1 [0189.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0189.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", lpFilePart=0x0) returned 0x31 [0189.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0189.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\9ez8l2ywj9h2ap_.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0189.914] GetFileType (hFile=0x3f4) returned 0x1 [0189.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0189.914] GetFileType (hFile=0x3f4) returned 0x1 [0189.923] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b7a60, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b7a60*, lpNumberOfBytesRead=0x55e794*=0x3512, lpOverlapped=0x0) returned 1 [0189.924] WriteFile (in: hFile=0x378, lpBuffer=0x24906c4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24906c4*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0189.926] WriteFile (in: hFile=0x378, lpBuffer=0x2492b9c*, nNumberOfBytesToWrite=0x2530, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2492b9c*, lpNumberOfBytesWritten=0x55e76c*=0x2530, lpOverlapped=0x0) returned 1 [0189.926] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b7a60, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b7a60*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0189.926] CloseHandle (hObject=0x3f4) returned 1 [0189.926] WriteFile (in: hFile=0x378, lpBuffer=0x24906c4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x24906c4*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0189.927] CloseHandle (hObject=0x378) returned 1 [0189.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0189.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png", lpFilePart=0x0) returned 0x31 [0189.929] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\9Ez8l2YWj9H2Ap_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\9ez8l2ywj9h2ap_.png")) returned 1 [0189.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0189.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif.jcrypt", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif.jcrypt", lpFilePart=0x0) returned 0x32 [0189.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0189.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\g tqczcek.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0189.932] GetFileType (hFile=0x378) returned 0x1 [0189.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0189.932] GetFileType (hFile=0x378) returned 0x1 [0191.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0191.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", lpFilePart=0x0) returned 0x2b [0191.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0191.598] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\g tqczcek.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0191.598] GetFileType (hFile=0x3f4) returned 0x1 [0191.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0191.599] GetFileType (hFile=0x3f4) returned 0x1 [0191.602] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0x7167, lpOverlapped=0x0) returned 1 [0191.621] WriteFile (in: hFile=0x378, lpBuffer=0x2576af0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2576af0*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0191.623] WriteFile (in: hFile=0x378, lpBuffer=0x2578fbc*, nNumberOfBytesToWrite=0x6180, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2578fbc*, lpNumberOfBytesWritten=0x55e76c*=0x6180, lpOverlapped=0x0) returned 1 [0191.624] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0191.624] CloseHandle (hObject=0x3f4) returned 1 [0191.624] WriteFile (in: hFile=0x378, lpBuffer=0x2576af0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2576af0*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0191.624] CloseHandle (hObject=0x378) returned 1 [0191.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0191.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif", lpFilePart=0x0) returned 0x2b [0191.629] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\g TQCzcEK.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\g tqczcek.gif")) returned 1 [0191.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0191.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg.jcrypt", nBufferLength=0x3d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg.jcrypt", lpFilePart=0x0) returned 0x3c [0191.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0191.647] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\mhhs6d_oyhmzhdxhd4d.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0191.647] GetFileType (hFile=0x378) returned 0x1 [0191.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0191.647] GetFileType (hFile=0x378) returned 0x1 [0192.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0192.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", lpFilePart=0x0) returned 0x35 [0192.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0192.960] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\mhhs6d_oyhmzhdxhd4d.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0192.961] GetFileType (hFile=0x3f4) returned 0x1 [0192.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0192.961] GetFileType (hFile=0x3f4) returned 0x1 [0192.964] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e794*=0xbe94, lpOverlapped=0x0) returned 1 [0192.977] WriteFile (in: hFile=0x378, lpBuffer=0x2460c38*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2460c38*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0192.978] WriteFile (in: hFile=0x378, lpBuffer=0x2463118*, nNumberOfBytesToWrite=0xaeb0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2463118*, lpNumberOfBytesWritten=0x55e76c*=0xaeb0, lpOverlapped=0x0) returned 1 [0192.979] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0192.979] CloseHandle (hObject=0x3f4) returned 1 [0192.979] WriteFile (in: hFile=0x378, lpBuffer=0x2460c38*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2460c38*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0192.979] CloseHandle (hObject=0x378) returned 1 [0192.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0192.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg", lpFilePart=0x0) returned 0x35 [0192.986] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\Mhhs6d_oyhmZHDXHD4D.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\mhhs6d_oyhmzhdxhd4d.jpg")) returned 1 [0192.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0192.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg.jcrypt", lpFilePart=0x0) returned 0x39 [0192.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0192.989] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\nfexwxsvtfrnnxmb.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0192.989] GetFileType (hFile=0x378) returned 0x1 [0192.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0192.989] GetFileType (hFile=0x378) returned 0x1 [0194.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0194.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", lpFilePart=0x0) returned 0x32 [0194.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0194.555] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\nfexwxsvtfrnnxmb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0194.555] GetFileType (hFile=0x3f4) returned 0x1 [0194.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0194.555] GetFileType (hFile=0x3f4) returned 0x1 [0194.558] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x6ab, lpOverlapped=0x0) returned 1 [0194.571] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0194.571] CloseHandle (hObject=0x3f4) returned 1 [0194.571] WriteFile (in: hFile=0x378, lpBuffer=0x25517d8*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x25517d8*, lpNumberOfBytesWritten=0x55e734*=0x6d0, lpOverlapped=0x0) returned 1 [0194.572] CloseHandle (hObject=0x378) returned 1 [0194.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0194.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg", lpFilePart=0x0) returned 0x32 [0194.573] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\NFEXwxsvTFrnNxmB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\nfexwxsvtfrnnxmb.jpg")) returned 1 [0194.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0194.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif.jcrypt", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif.jcrypt", lpFilePart=0x0) returned 0x34 [0194.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0194.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\peotiwfgxg0.gif.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0194.580] GetFileType (hFile=0x378) returned 0x1 [0194.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0194.580] GetFileType (hFile=0x378) returned 0x1 [0195.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0195.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", lpFilePart=0x0) returned 0x2d [0195.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0195.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\peotiwfgxg0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0195.997] GetFileType (hFile=0x3f4) returned 0x1 [0195.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0195.997] GetFileType (hFile=0x3f4) returned 0x1 [0196.001] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x66c1, lpOverlapped=0x0) returned 1 [0196.025] WriteFile (in: hFile=0x378, lpBuffer=0x2434eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2434eec*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0196.026] WriteFile (in: hFile=0x378, lpBuffer=0x24373bc*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24373bc*, lpNumberOfBytesWritten=0x55e76c*=0x56e0, lpOverlapped=0x0) returned 1 [0196.027] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0196.027] CloseHandle (hObject=0x3f4) returned 1 [0196.027] WriteFile (in: hFile=0x378, lpBuffer=0x2434eec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2434eec*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0196.028] CloseHandle (hObject=0x378) returned 1 [0196.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0196.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif", lpFilePart=0x0) returned 0x2d [0196.030] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PeOTIWfGxG0.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\peotiwfgxg0.gif")) returned 1 [0196.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0196.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp.jcrypt", nBufferLength=0x3b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp.jcrypt", lpFilePart=0x0) returned 0x3a [0196.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0196.043] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\pmc02kfdiluquzmf2.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0196.043] GetFileType (hFile=0x378) returned 0x1 [0196.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0196.043] GetFileType (hFile=0x378) returned 0x1 [0197.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0197.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", lpFilePart=0x0) returned 0x33 [0197.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0197.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\pmc02kfdiluquzmf2.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0197.541] GetFileType (hFile=0x3f4) returned 0x1 [0197.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0197.541] GetFileType (hFile=0x3f4) returned 0x1 [0197.545] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x1bfd, lpOverlapped=0x0) returned 1 [0197.561] WriteFile (in: hFile=0x378, lpBuffer=0x251e6d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x251e6d8*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0197.562] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0197.563] CloseHandle (hObject=0x3f4) returned 1 [0197.563] WriteFile (in: hFile=0x378, lpBuffer=0x251e6d8*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x251e6d8*, lpNumberOfBytesWritten=0x55e734*=0xc20, lpOverlapped=0x0) returned 1 [0197.563] CloseHandle (hObject=0x378) returned 1 [0197.566] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0197.566] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp", lpFilePart=0x0) returned 0x33 [0197.566] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\PmC02kFDILUQuzmf2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\pmc02kfdiluquzmf2.bmp")) returned 1 [0197.571] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0197.571] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp.jcrypt", lpFilePart=0x0) returned 0x39 [0197.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0197.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\trwldnhajvllnmll.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0197.572] GetFileType (hFile=0x378) returned 0x1 [0197.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0197.573] GetFileType (hFile=0x378) returned 0x1 [0199.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0199.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", lpFilePart=0x0) returned 0x32 [0199.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0199.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\trwldnhajvllnmll.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0199.577] GetFileType (hFile=0x3f4) returned 0x1 [0199.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0199.577] GetFileType (hFile=0x3f4) returned 0x1 [0199.580] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x11086, lpOverlapped=0x0) returned 1 [0199.595] WriteFile (in: hFile=0x378, lpBuffer=0x2403cdc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2403cdc*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0199.596] WriteFile (in: hFile=0x378, lpBuffer=0x24061b8*, nNumberOfBytesToWrite=0x100a0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24061b8*, lpNumberOfBytesWritten=0x55e76c*=0x100a0, lpOverlapped=0x0) returned 1 [0199.597] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0199.597] CloseHandle (hObject=0x3f4) returned 1 [0199.598] WriteFile (in: hFile=0x378, lpBuffer=0x2403cdc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2403cdc*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0199.598] CloseHandle (hObject=0x378) returned 1 [0199.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0199.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp", lpFilePart=0x0) returned 0x32 [0199.600] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\TrWLdnhAjVLLnMll.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\trwldnhajvllnmll.bmp")) returned 1 [0199.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0199.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp.jcrypt", lpFilePart=0x0) returned 0x33 [0199.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0199.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\w7ygswnkw2.bmp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0199.648] GetFileType (hFile=0x378) returned 0x1 [0199.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0199.648] GetFileType (hFile=0x378) returned 0x1 [0201.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0201.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", lpFilePart=0x0) returned 0x2c [0201.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0201.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\w7ygswnkw2.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0201.995] GetFileType (hFile=0x3f4) returned 0x1 [0201.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0201.995] GetFileType (hFile=0x3f4) returned 0x1 [0201.998] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x12883, lpOverlapped=0x0) returned 1 [0202.018] WriteFile (in: hFile=0x378, lpBuffer=0x24f7ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24f7ed8*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0202.020] WriteFile (in: hFile=0x378, lpBuffer=0x24fa3a8*, nNumberOfBytesToWrite=0x118a0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24fa3a8*, lpNumberOfBytesWritten=0x55e76c*=0x118a0, lpOverlapped=0x0) returned 1 [0202.022] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0202.022] CloseHandle (hObject=0x3f4) returned 1 [0202.022] WriteFile (in: hFile=0x378, lpBuffer=0x24f7ed8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x24f7ed8*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0202.022] CloseHandle (hObject=0x378) returned 1 [0202.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0202.029] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp", lpFilePart=0x0) returned 0x2c [0202.029] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\W7ygSWnKW2.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\w7ygswnkw2.bmp")) returned 1 [0202.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0202.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg.jcrypt", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg.jcrypt", lpFilePart=0x0) returned 0x31 [0202.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0202.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\wz9ypnb0.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0202.088] GetFileType (hFile=0x378) returned 0x1 [0202.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0202.088] GetFileType (hFile=0x378) returned 0x1 [0204.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0204.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", lpFilePart=0x0) returned 0x2a [0204.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0204.798] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\wz9ypnb0.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0204.799] GetFileType (hFile=0x3f4) returned 0x1 [0204.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0204.799] GetFileType (hFile=0x3f4) returned 0x1 [0204.844] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x2f39, lpOverlapped=0x0) returned 1 [0204.859] WriteFile (in: hFile=0x378, lpBuffer=0x23ed934*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x23ed934*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0204.860] WriteFile (in: hFile=0x378, lpBuffer=0x23efe00*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x23efe00*, lpNumberOfBytesWritten=0x55e76c*=0x1f50, lpOverlapped=0x0) returned 1 [0204.861] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0204.861] CloseHandle (hObject=0x3f4) returned 1 [0204.861] WriteFile (in: hFile=0x378, lpBuffer=0x23ed934*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x23ed934*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0204.862] CloseHandle (hObject=0x378) returned 1 [0204.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0204.863] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg", lpFilePart=0x0) returned 0x2a [0204.863] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\wZ9yPnB0.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\wz9ypnb0.jpg")) returned 1 [0204.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0204.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png.jcrypt", lpFilePart=0x0) returned 0x33 [0204.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0204.915] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\xtwfi5z02m.png.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0204.916] GetFileType (hFile=0x378) returned 0x1 [0204.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0204.916] GetFileType (hFile=0x378) returned 0x1 [0207.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0207.589] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", lpFilePart=0x0) returned 0x2c [0207.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0207.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\xtwfi5z02m.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0207.590] GetFileType (hFile=0x3f4) returned 0x1 [0207.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0207.590] GetFileType (hFile=0x3f4) returned 0x1 [0207.594] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x131ea, lpOverlapped=0x0) returned 1 [0207.612] WriteFile (in: hFile=0x378, lpBuffer=0x24d57d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24d57d8*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0207.664] WriteFile (in: hFile=0x378, lpBuffer=0x24d7ca8*, nNumberOfBytesToWrite=0x12200, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24d7ca8*, lpNumberOfBytesWritten=0x55e76c*=0x12200, lpOverlapped=0x0) returned 1 [0207.665] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0207.666] CloseHandle (hObject=0x3f4) returned 1 [0207.666] WriteFile (in: hFile=0x378, lpBuffer=0x24d57d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x24d57d8*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0207.666] CloseHandle (hObject=0x378) returned 1 [0207.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0207.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png", lpFilePart=0x0) returned 0x2c [0207.673] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\xTWFi5Z02m.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\xtwfi5z02m.png")) returned 1 [0207.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0207.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg.jcrypt", nBufferLength=0x3b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg.jcrypt", lpFilePart=0x0) returned 0x3a [0207.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0207.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\yvagkl85d9tybhdvl.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0207.732] GetFileType (hFile=0x378) returned 0x1 [0207.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0207.732] GetFileType (hFile=0x378) returned 0x1 [0210.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0210.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", lpFilePart=0x0) returned 0x33 [0210.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0210.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\yvagkl85d9tybhdvl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0210.347] GetFileType (hFile=0x3f4) returned 0x1 [0210.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0210.347] GetFileType (hFile=0x3f4) returned 0x1 [0210.350] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x7c6, lpOverlapped=0x0) returned 1 [0210.416] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0210.416] CloseHandle (hObject=0x3f4) returned 1 [0210.416] WriteFile (in: hFile=0x378, lpBuffer=0x23cbcd4*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x23cbcd4*, lpNumberOfBytesWritten=0x55e734*=0x7f0, lpOverlapped=0x0) returned 1 [0210.417] CloseHandle (hObject=0x378) returned 1 [0210.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0210.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg", lpFilePart=0x0) returned 0x33 [0210.419] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\yVagKL85d9TybhDvL.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\yvagkl85d9tybhdvl.jpg")) returned 1 [0210.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0210.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg.jcrypt", lpFilePart=0x0) returned 0x30 [0210.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0210.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\zv435yj.jpg.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0210.462] GetFileType (hFile=0x378) returned 0x1 [0210.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0210.462] GetFileType (hFile=0x378) returned 0x1 [0213.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0213.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", lpFilePart=0x0) returned 0x29 [0213.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0213.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\zv435yj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0213.186] GetFileType (hFile=0x3f4) returned 0x1 [0213.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0213.186] GetFileType (hFile=0x3f4) returned 0x1 [0213.189] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0xe874, lpOverlapped=0x0) returned 1 [0213.260] WriteFile (in: hFile=0x378, lpBuffer=0x24af798*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24af798*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0213.262] WriteFile (in: hFile=0x378, lpBuffer=0x24b1c60*, nNumberOfBytesToWrite=0xd890, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24b1c60*, lpNumberOfBytesWritten=0x55e76c*=0xd890, lpOverlapped=0x0) returned 1 [0213.263] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0213.263] CloseHandle (hObject=0x3f4) returned 1 [0213.263] WriteFile (in: hFile=0x378, lpBuffer=0x24af798*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x24af798*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0213.264] CloseHandle (hObject=0x378) returned 1 [0213.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0213.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg", lpFilePart=0x0) returned 0x29 [0213.384] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\zv435yj.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\b0zd\\zv435yj.jpg")) returned 1 [0213.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0213.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0213.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd", nBufferLength=0x1e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\B0Zd", lpFilePart=0x0) returned 0x1d [0213.386] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\B0Zd\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0xaa9965, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xea58bca, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e4a8 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x128157c0, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0xaa9965, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xea58bca, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa457f4, ftCreationTime.dwHighDateTime=0x1d6d767, ftLastAccessTime.dwLowDateTime=0xffa457f4, ftLastAccessTime.dwHighDateTime=0x1d6d767, ftLastWriteTime.dwLowDateTime=0xaa9965, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x3540, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Ez8l2YWj9H2Ap_.png.jcrypt", cAlternateFileName="9EZ8L2~1.JCR")) returned 1 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa9965, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xaa9965, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1ae7930, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x7190, dwReserved0=0x0, dwReserved1=0x0, cFileName="g TQCzcEK.gif.jcrypt", cAlternateFileName="GTQCZC~1.JCR")) returned 1 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b15a0b, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1b15a0b, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x27e0407, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xbec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhhs6d_oyhmZHDXHD4D.jpg.jcrypt", cAlternateFileName="MHHS6D~1.JCR")) returned 1 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e0407, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x27e0407, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x36f5c26, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NFEXwxsvTFrnNxmB.jpg.jcrypt", cAlternateFileName="NFEXWX~1.JCR")) returned 1 [0213.387] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371be47, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x371be47, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x44d1703, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x66f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeOTIWfGxG0.gif.jcrypt", cAlternateFileName="PEOTIW~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44f7a27, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x44f7a27, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x53921e9, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x1c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PmC02kFDILUQuzmf2.bmp.jcrypt", cAlternateFileName="PMC02K~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53921e9, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x53921e9, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x66f709b, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x110b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrWLdnhAjVLLnMll.bmp.jcrypt", cAlternateFileName="TRWLDN~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676980c, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x676980c, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x7e0fd3a, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7ygSWnKW2.bmp.jcrypt", cAlternateFileName="W7YGSW~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ea87e1, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x7ea87e1, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x992ee5b, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x2f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="wZ9yPnB0.jpg.jcrypt", cAlternateFileName="WZ9YPN~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a1419, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x99a1419, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xb3db228, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x13210, dwReserved0=0x0, dwReserved1=0x0, cFileName="xTWFi5Z02m.png.jcrypt", cAlternateFileName="XTWFI5~1.JCR")) returned 1 [0213.388] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb478071, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xb478071, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xce196d6, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="yVagKL85d9TybhDvL.jpg.jcrypt", cAlternateFileName="YVAGKL~1.JCR")) returned 1 [0213.389] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce8bdb2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xce8bdb2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xea58bca, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zv435yj.jpg.jcrypt", cAlternateFileName="ZV435Y~1.JCR")) returned 1 [0213.389] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce8bdb2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xce8bdb2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0xea58bca, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zv435yj.jpg.jcrypt", cAlternateFileName="ZV435Y~1.JCR")) returned 0 [0213.389] FindClose (in: hFindFile=0x76e4a8 | out: hFindFile=0x76e4a8) returned 1 [0213.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0213.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0213.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0213.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0213.390] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0213.390] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dfe8 [0213.391] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.391] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.392] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.392] FindClose (in: hFindFile=0x76dfe8 | out: hFindFile=0x76dfe8) returned 1 [0213.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0213.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0213.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0213.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.jcrypt", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x37 [0213.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0213.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0213.393] GetFileType (hFile=0x378) returned 0x1 [0213.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0213.394] GetFileType (hFile=0x378) returned 0x1 [0218.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0218.030] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0218.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0218.031] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0218.045] GetFileType (hFile=0x3f4) returned 0x1 [0218.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0218.045] GetFileType (hFile=0x3f4) returned 0x1 [0218.048] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0xbe, lpOverlapped=0x0) returned 1 [0218.060] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0218.060] CloseHandle (hObject=0x3f4) returned 1 [0218.061] WriteFile (in: hFile=0x378, lpBuffer=0x23a399c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x23a399c*, lpNumberOfBytesWritten=0x55e734*=0xe0, lpOverlapped=0x0) returned 1 [0218.062] CloseHandle (hObject=0x378) returned 1 [0218.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0218.065] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x30 [0218.065] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini")) returned 1 [0218.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0218.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0218.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0218.066] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x116fb20e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e328 [0218.066] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x116fb20e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.066] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7ecb2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xea7ecb2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x116fb20e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 1 [0218.066] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7ecb2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0xea7ecb2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x116fb20e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 0 [0218.067] FindClose (in: hFindFile=0x76e328 | out: hFindFile=0x76e328) returned 1 [0218.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0218.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0218.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0218.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0218.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0218.067] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dee8 [0218.067] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.068] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0218.068] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.068] FindClose (in: hFindFile=0x76dee8 | out: hFindFile=0x76dee8) returned 1 [0218.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0218.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0218.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0218.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.jcrypt", nBufferLength=0x3b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x3a [0218.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0218.069] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0218.069] GetFileType (hFile=0x378) returned 0x1 [0218.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0218.069] GetFileType (hFile=0x378) returned 0x1 [0221.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0221.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0221.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0221.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0221.466] GetFileType (hFile=0x3f4) returned 0x1 [0221.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0221.466] GetFileType (hFile=0x3f4) returned 0x1 [0221.469] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0xbe, lpOverlapped=0x0) returned 1 [0221.538] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0221.538] CloseHandle (hObject=0x3f4) returned 1 [0221.538] WriteFile (in: hFile=0x378, lpBuffer=0x2487b64*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2487b64*, lpNumberOfBytesWritten=0x55e734*=0xe0, lpOverlapped=0x0) returned 1 [0221.539] CloseHandle (hObject=0x378) returned 1 [0221.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0221.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x33 [0221.540] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini")) returned 1 [0221.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0221.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0221.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0221.542] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x13835f87, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e2a8 [0221.542] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x13835f87, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.542] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116fb20e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x116fb20e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x13835f87, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 1 [0221.542] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x116fb20e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x116fb20e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x13835f87, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 0 [0221.542] FindClose (in: hFindFile=0x76e2a8 | out: hFindFile=0x76e2a8) returned 1 [0221.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0221.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0221.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e8cc) returned 1 [0221.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0221.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0221.543] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x55e5f4 | out: lpFindFileData=0x55e5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6babe23, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6babe23, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e1e8 [0221.543] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe6babe23, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe6babe23, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.543] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0f4b70, ftCreationTime.dwHighDateTime=0x1d5e5eb, ftLastAccessTime.dwLowDateTime=0x7b3015f0, ftLastAccessTime.dwHighDateTime=0x1d5e0e1, ftLastWriteTime.dwLowDateTime=0x7b3015f0, ftLastWriteTime.dwHighDateTime=0x1d5e0e1, nFileSizeHigh=0x0, nFileSizeLow=0x10a41, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NfmAFsZPq_z.doc", cAlternateFileName="-NFMAF~1.DOC")) returned 1 [0221.543] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3ea4f0, ftCreationTime.dwHighDateTime=0x1d57e13, ftLastAccessTime.dwLowDateTime=0x116a4990, ftLastAccessTime.dwHighDateTime=0x1d5b8d9, ftLastWriteTime.dwLowDateTime=0x116a4990, ftLastWriteTime.dwHighDateTime=0x1d5b8d9, nFileSizeHigh=0x0, nFileSizeLow=0x3c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BdAogwesXfT1I405G1.xlsx", cAlternateFileName="4BDAOG~1.XLS")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc418bb90, ftCreationTime.dwHighDateTime=0x1d5e6d7, ftLastAccessTime.dwLowDateTime=0x756d8590, ftLastAccessTime.dwHighDateTime=0x1d5e4f5, ftLastWriteTime.dwLowDateTime=0x756d8590, ftLastWriteTime.dwHighDateTime=0x1d5e4f5, nFileSizeHigh=0x0, nFileSizeLow=0x42ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 Pw2hm5wA.rtf", cAlternateFileName="5PW2HM~1.RTF")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa568e520, ftCreationTime.dwHighDateTime=0x1d57ef5, ftLastAccessTime.dwLowDateTime=0xc4bc1370, ftLastAccessTime.dwHighDateTime=0x1d5cd9c, ftLastWriteTime.dwLowDateTime=0xc4bc1370, ftLastWriteTime.dwHighDateTime=0x1d5cd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1262c, dwReserved0=0x0, dwReserved1=0x0, cFileName="50rlfcTzJyiex7_.pptx", cAlternateFileName="50RLFC~1.PPT")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ed0cc70, ftCreationTime.dwHighDateTime=0x1d572a1, ftLastAccessTime.dwLowDateTime=0x1900b60, ftLastAccessTime.dwHighDateTime=0x1d5bab2, ftLastWriteTime.dwLowDateTime=0x1900b60, ftLastWriteTime.dwHighDateTime=0x1d5bab2, nFileSizeHigh=0x0, nFileSizeLow=0x11056, dwReserved0=0x0, dwReserved1=0x0, cFileName="a-wGo AGT.pptx", cAlternateFileName="A-WGOA~1.PPT")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bacb9a0, ftCreationTime.dwHighDateTime=0x1d56911, ftLastAccessTime.dwLowDateTime=0x7a5c8b60, ftLastAccessTime.dwHighDateTime=0x1d5ab01, ftLastWriteTime.dwLowDateTime=0x7a5c8b60, ftLastWriteTime.dwHighDateTime=0x1d5ab01, nFileSizeHigh=0x0, nFileSizeLow=0x18db4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG9j.xlsx", cAlternateFileName="BG9J~1.XLS")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e644dd0, ftCreationTime.dwHighDateTime=0x1d5817b, ftLastAccessTime.dwLowDateTime=0x93063570, ftLastAccessTime.dwHighDateTime=0x1d57c3b, ftLastWriteTime.dwLowDateTime=0x93063570, ftLastWriteTime.dwHighDateTime=0x1d57c3b, nFileSizeHigh=0x0, nFileSizeLow=0x1552b, dwReserved0=0x0, dwReserved1=0x0, cFileName="c02Ledr_gXGZy4xb4Y4.pptx", cAlternateFileName="C02LED~1.PPT")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d40bd0, ftCreationTime.dwHighDateTime=0x1d5e6f3, ftLastAccessTime.dwLowDateTime=0xfc7f2060, ftLastAccessTime.dwHighDateTime=0x1d5e528, ftLastWriteTime.dwLowDateTime=0xfc7f2060, ftLastWriteTime.dwHighDateTime=0x1d5e528, nFileSizeHigh=0x0, nFileSizeLow=0x75ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd3SMNbx.odp", cAlternateFileName="")) returned 1 [0221.544] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x4eaa2250, ftLastWriteTime.dwHighDateTime=0x1d5e51e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4FJy", cAlternateFileName="")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x582fb6b0, ftCreationTime.dwHighDateTime=0x1d58bae, ftLastAccessTime.dwLowDateTime=0x18601c90, ftLastAccessTime.dwHighDateTime=0x1d5eba9, ftLastWriteTime.dwLowDateTime=0x18601c90, ftLastWriteTime.dwHighDateTime=0x1d5eba9, nFileSizeHigh=0x0, nFileSizeLow=0xc11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1FyTmwO.xlsx", cAlternateFileName="F1FYTM~1.XLS")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8551f40, ftCreationTime.dwHighDateTime=0x1d57808, ftLastAccessTime.dwLowDateTime=0x40d54b90, ftLastAccessTime.dwHighDateTime=0x1d56e5a, ftLastWriteTime.dwLowDateTime=0x40d54b90, ftLastWriteTime.dwHighDateTime=0x1d56e5a, nFileSizeHigh=0x0, nFileSizeLow=0x128ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FMlO.pptx", cAlternateFileName="FMLO~1.PPT")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6d9c00, ftCreationTime.dwHighDateTime=0x1d56f5c, ftLastAccessTime.dwLowDateTime=0x5fc08700, ftLastAccessTime.dwHighDateTime=0x1d56e36, ftLastWriteTime.dwLowDateTime=0x5fc08700, ftLastWriteTime.dwHighDateTime=0x1d56e36, nFileSizeHigh=0x0, nFileSizeLow=0x3370, dwReserved0=0x0, dwReserved1=0x0, cFileName="gjlGum9 _Ee85bqcuUI.docx", cAlternateFileName="GJLGUM~1.DOC")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2ad050, ftCreationTime.dwHighDateTime=0x1d5e332, ftLastAccessTime.dwLowDateTime=0xc3ff9c10, ftLastAccessTime.dwHighDateTime=0x1d58470, ftLastWriteTime.dwLowDateTime=0xc3ff9c10, ftLastWriteTime.dwHighDateTime=0x1d58470, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gzhhv.docx", cAlternateFileName="GZHHV~1.DOC")) returned 1 [0221.545] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbddcf120, ftCreationTime.dwHighDateTime=0x1d5e749, ftLastAccessTime.dwLowDateTime=0xf34a3110, ftLastAccessTime.dwHighDateTime=0x1d5e2a3, ftLastWriteTime.dwLowDateTime=0xf34a3110, ftLastWriteTime.dwHighDateTime=0x1d5e2a3, nFileSizeHigh=0x0, nFileSizeLow=0xe4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="hSyH_j.pps", cAlternateFileName="")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c2c08f0, ftCreationTime.dwHighDateTime=0x1d57b93, ftLastAccessTime.dwLowDateTime=0x60f22450, ftLastAccessTime.dwHighDateTime=0x1d56ce5, ftLastWriteTime.dwLowDateTime=0x60f22450, ftLastWriteTime.dwHighDateTime=0x1d56ce5, nFileSizeHigh=0x0, nFileSizeLow=0x13d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iYXTlnvoNiNy.docx", cAlternateFileName="IYXTLN~1.DOC")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f11600, ftCreationTime.dwHighDateTime=0x1d5e2ec, ftLastAccessTime.dwLowDateTime=0x5dc4f290, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x5dc4f290, ftLastWriteTime.dwHighDateTime=0x1d5e14c, nFileSizeHigh=0x0, nFileSizeLow=0xf878, dwReserved0=0x0, dwReserved1=0x0, cFileName="jDLzaKs.rtf", cAlternateFileName="")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff928b0, ftCreationTime.dwHighDateTime=0x1d59ea6, ftLastAccessTime.dwLowDateTime=0x4f8c7a90, ftLastAccessTime.dwHighDateTime=0x1d59462, ftLastWriteTime.dwLowDateTime=0x4f8c7a90, ftLastWriteTime.dwHighDateTime=0x1d59462, nFileSizeHigh=0x0, nFileSizeLow=0x11e38, dwReserved0=0x0, dwReserved1=0x0, cFileName="mDxbgSUyUSVOLd.xlsx", cAlternateFileName="MDXBGS~1.XLS")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0221.546] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce1ed0, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x635afb00, ftLastAccessTime.dwHighDateTime=0x1d5e7c8, ftLastWriteTime.dwLowDateTime=0x635afb00, ftLastWriteTime.dwHighDateTime=0x1d5e7c8, nFileSizeHigh=0x0, nFileSizeLow=0x15e0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="P2MPoRKsx0l.pps", cAlternateFileName="P2MPOR~1.PPS")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded49b10, ftCreationTime.dwHighDateTime=0x1d58e54, ftLastAccessTime.dwLowDateTime=0x80816580, ftLastAccessTime.dwHighDateTime=0x1d59943, ftLastWriteTime.dwLowDateTime=0x80816580, ftLastWriteTime.dwHighDateTime=0x1d59943, nFileSizeHigh=0x0, nFileSizeLow=0x445f, dwReserved0=0x0, dwReserved1=0x0, cFileName="pwafdbOk.docx", cAlternateFileName="PWAFDB~1.DOC")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a54f5b0, ftCreationTime.dwHighDateTime=0x1d5a79d, ftLastAccessTime.dwLowDateTime=0x83da0d90, ftLastAccessTime.dwHighDateTime=0x1d5c02b, ftLastWriteTime.dwLowDateTime=0x83da0d90, ftLastWriteTime.dwHighDateTime=0x1d5c02b, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2BfZDNyzrms2OQqw.docx", cAlternateFileName="R2BFZD~1.DOC")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8df600, ftCreationTime.dwHighDateTime=0x1d5b0ee, ftLastAccessTime.dwLowDateTime=0xb9480950, ftLastAccessTime.dwHighDateTime=0x1d5a235, ftLastWriteTime.dwLowDateTime=0xb9480950, ftLastWriteTime.dwHighDateTime=0x1d5a235, nFileSizeHigh=0x0, nFileSizeLow=0xd6fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="RW-I958R_YAEhKgr7.pptx", cAlternateFileName="RW-I95~1.PPT")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28e8c2d0, ftCreationTime.dwHighDateTime=0x1d5ee68, ftLastAccessTime.dwLowDateTime=0xa8197090, ftLastAccessTime.dwHighDateTime=0x1d5eb9d, ftLastWriteTime.dwLowDateTime=0xa8197090, ftLastWriteTime.dwHighDateTime=0x1d5eb9d, nFileSizeHigh=0x0, nFileSizeLow=0x11031, dwReserved0=0x0, dwReserved1=0x0, cFileName="SF9WY2B71.pps", cAlternateFileName="SF9WY2~1.PPS")) returned 1 [0221.547] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6bbffc0, ftCreationTime.dwHighDateTime=0x1d5a60a, ftLastAccessTime.dwLowDateTime=0xedfdb410, ftLastAccessTime.dwHighDateTime=0x1d5b3bf, ftLastWriteTime.dwLowDateTime=0xedfdb410, ftLastWriteTime.dwHighDateTime=0x1d5b3bf, nFileSizeHigh=0x0, nFileSizeLow=0x4208, dwReserved0=0x0, dwReserved1=0x0, cFileName="wJIi77j.xlsx", cAlternateFileName="WJII77~1.XLS")) returned 1 [0221.548] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1399fe0, ftCreationTime.dwHighDateTime=0x1d5e3bc, ftLastAccessTime.dwLowDateTime=0xabf43e30, ftLastAccessTime.dwHighDateTime=0x1d5ed68, ftLastWriteTime.dwLowDateTime=0xabf43e30, ftLastWriteTime.dwHighDateTime=0x1d5ed68, nFileSizeHigh=0x0, nFileSizeLow=0x1f5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y mk8du6Lt_hcV-.rtf", cAlternateFileName="YMK8DU~1.RTF")) returned 1 [0221.548] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe113ae70, ftCreationTime.dwHighDateTime=0x1d5eb42, ftLastAccessTime.dwLowDateTime=0xd84283c0, ftLastAccessTime.dwHighDateTime=0x1d5f0f1, ftLastWriteTime.dwLowDateTime=0xd84283c0, ftLastWriteTime.dwHighDateTime=0x1d5f0f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="_8kLSgjP-Ebcj8bmjSKn.xlsx", cAlternateFileName="_8KLSG~1.XLS")) returned 1 [0221.548] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.548] FindClose (in: hFindFile=0x76e1e8 | out: hFindFile=0x76e1e8) returned 1 [0221.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e888) returned 1 [0221.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e894) returned 1 [0221.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0221.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc.jcrypt", nBufferLength=0x32, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc.jcrypt", lpFilePart=0x0) returned 0x31 [0221.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0221.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\-nfmafszpq_z.doc.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0221.550] GetFileType (hFile=0x378) returned 0x1 [0221.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0221.550] GetFileType (hFile=0x378) returned 0x1 [0224.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0224.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", lpFilePart=0x0) returned 0x2a [0224.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0224.472] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc" (normalized: "c:\\users\\fd1hvy\\documents\\-nfmafszpq_z.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0224.472] GetFileType (hFile=0x3f4) returned 0x1 [0224.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0224.472] GetFileType (hFile=0x3f4) returned 0x1 [0224.475] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x10a41, lpOverlapped=0x0) returned 1 [0224.491] WriteFile (in: hFile=0x378, lpBuffer=0x2564f28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2564f28*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0224.492] WriteFile (in: hFile=0x378, lpBuffer=0x25673fc*, nNumberOfBytesToWrite=0xfa60, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25673fc*, lpNumberOfBytesWritten=0x55e7d0*=0xfa60, lpOverlapped=0x0) returned 1 [0224.493] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0224.493] CloseHandle (hObject=0x3f4) returned 1 [0224.493] WriteFile (in: hFile=0x378, lpBuffer=0x2564f28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2564f28*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0224.494] CloseHandle (hObject=0x378) returned 1 [0224.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0224.496] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc", lpFilePart=0x0) returned 0x2a [0224.496] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-NfmAFsZPq_z.doc" (normalized: "c:\\users\\fd1hvy\\documents\\-nfmafszpq_z.doc")) returned 1 [0224.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0224.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx.jcrypt", lpFilePart=0x0) returned 0x39 [0224.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0224.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\4bdaogwesxft1i405g1.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0224.560] GetFileType (hFile=0x378) returned 0x1 [0224.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0224.560] GetFileType (hFile=0x378) returned 0x1 [0227.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0227.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", lpFilePart=0x0) returned 0x32 [0227.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0227.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4bdaogwesxft1i405g1.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0227.253] GetFileType (hFile=0x3f4) returned 0x1 [0227.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0227.253] GetFileType (hFile=0x3f4) returned 0x1 [0227.258] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x3c01, lpOverlapped=0x0) returned 1 [0227.323] WriteFile (in: hFile=0x378, lpBuffer=0x245bc28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x245bc28*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0227.325] WriteFile (in: hFile=0x378, lpBuffer=0x245e10c*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x245e10c*, lpNumberOfBytesWritten=0x55e7d0*=0x2c20, lpOverlapped=0x0) returned 1 [0227.326] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0227.326] CloseHandle (hObject=0x3f4) returned 1 [0227.326] WriteFile (in: hFile=0x378, lpBuffer=0x245bc28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x245bc28*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0227.326] CloseHandle (hObject=0x378) returned 1 [0227.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0227.329] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx", lpFilePart=0x0) returned 0x32 [0227.329] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4BdAogwesXfT1I405G1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\4bdaogwesxft1i405g1.xlsx")) returned 1 [0227.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0227.389] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf.jcrypt", nBufferLength=0x30, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf.jcrypt", lpFilePart=0x0) returned 0x2f [0227.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0227.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\5 pw2hm5wa.rtf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0227.390] GetFileType (hFile=0x378) returned 0x1 [0227.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0227.390] GetFileType (hFile=0x378) returned 0x1 [0230.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0230.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", lpFilePart=0x0) returned 0x28 [0230.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0230.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\5 pw2hm5wa.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0230.160] GetFileType (hFile=0x3f4) returned 0x1 [0230.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0230.160] GetFileType (hFile=0x3f4) returned 0x1 [0230.164] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x42ce, lpOverlapped=0x0) returned 1 [0230.202] WriteFile (in: hFile=0x378, lpBuffer=0x2545210*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2545210*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0230.203] WriteFile (in: hFile=0x378, lpBuffer=0x25476e0*, nNumberOfBytesToWrite=0x32e0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25476e0*, lpNumberOfBytesWritten=0x55e7d0*=0x32e0, lpOverlapped=0x0) returned 1 [0230.204] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0230.204] CloseHandle (hObject=0x3f4) returned 1 [0230.204] WriteFile (in: hFile=0x378, lpBuffer=0x2545210*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2545210*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0230.204] CloseHandle (hObject=0x378) returned 1 [0230.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0230.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf", lpFilePart=0x0) returned 0x28 [0230.213] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\5 Pw2hm5wA.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\5 pw2hm5wa.rtf")) returned 1 [0230.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0230.216] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx.jcrypt", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx.jcrypt", lpFilePart=0x0) returned 0x35 [0230.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0230.216] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\50rlfctzjyiex7_.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0230.216] GetFileType (hFile=0x378) returned 0x1 [0230.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0230.216] GetFileType (hFile=0x378) returned 0x1 [0231.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0231.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", lpFilePart=0x0) returned 0x2e [0231.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0231.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\50rlfctzjyiex7_.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0231.815] GetFileType (hFile=0x3f4) returned 0x1 [0231.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0231.815] GetFileType (hFile=0x3f4) returned 0x1 [0231.818] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x1262c, lpOverlapped=0x0) returned 1 [0231.849] WriteFile (in: hFile=0x378, lpBuffer=0x242efac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x242efac*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0231.851] WriteFile (in: hFile=0x378, lpBuffer=0x2431488*, nNumberOfBytesToWrite=0x11640, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2431488*, lpNumberOfBytesWritten=0x55e7d0*=0x11640, lpOverlapped=0x0) returned 1 [0231.852] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0231.852] CloseHandle (hObject=0x3f4) returned 1 [0231.852] WriteFile (in: hFile=0x378, lpBuffer=0x242efac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x242efac*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0231.852] CloseHandle (hObject=0x378) returned 1 [0231.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0231.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx", lpFilePart=0x0) returned 0x2e [0231.855] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\50rlfcTzJyiex7_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\50rlfctzjyiex7_.pptx")) returned 1 [0231.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0231.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx.jcrypt", nBufferLength=0x30, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx.jcrypt", lpFilePart=0x0) returned 0x2f [0231.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0231.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\a-wgo agt.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0231.888] GetFileType (hFile=0x378) returned 0x1 [0231.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0231.889] GetFileType (hFile=0x378) returned 0x1 [0233.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0233.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", lpFilePart=0x0) returned 0x28 [0233.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0233.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a-wgo agt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0233.262] GetFileType (hFile=0x3f4) returned 0x1 [0233.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0233.262] GetFileType (hFile=0x3f4) returned 0x1 [0233.265] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x11056, lpOverlapped=0x0) returned 1 [0233.286] WriteFile (in: hFile=0x378, lpBuffer=0x2528b7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2528b7c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0233.288] WriteFile (in: hFile=0x378, lpBuffer=0x252b04c*, nNumberOfBytesToWrite=0x10070, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x252b04c*, lpNumberOfBytesWritten=0x55e7d0*=0x10070, lpOverlapped=0x0) returned 1 [0233.289] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0233.289] CloseHandle (hObject=0x3f4) returned 1 [0233.289] WriteFile (in: hFile=0x378, lpBuffer=0x2528b7c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2528b7c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0233.290] CloseHandle (hObject=0x378) returned 1 [0233.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0233.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", nBufferLength=0x29, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx", lpFilePart=0x0) returned 0x28 [0233.292] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\a-wGo AGT.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a-wgo agt.pptx")) returned 1 [0233.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0233.307] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx.jcrypt", lpFilePart=0x0) returned 0x2a [0233.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0233.307] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\bg9j.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0233.308] GetFileType (hFile=0x378) returned 0x1 [0233.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0233.308] GetFileType (hFile=0x378) returned 0x1 [0235.043] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0235.044] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", lpFilePart=0x0) returned 0x23 [0235.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0235.044] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bg9j.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0235.044] GetFileType (hFile=0x3f4) returned 0x1 [0235.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0235.045] GetFileType (hFile=0x3f4) returned 0x1 [0235.048] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x18db4, lpOverlapped=0x0) returned 1 [0235.088] WriteFile (in: hFile=0x378, lpBuffer=0x241d134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x241d134*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0235.090] WriteFile (in: hFile=0x378, lpBuffer=0x36a1580*, nNumberOfBytesToWrite=0x17dd0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x36a1580*, lpNumberOfBytesWritten=0x55e7d0*=0x17dd0, lpOverlapped=0x0) returned 1 [0235.093] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0235.093] CloseHandle (hObject=0x3f4) returned 1 [0235.093] WriteFile (in: hFile=0x378, lpBuffer=0x241d134*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x241d134*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0235.094] CloseHandle (hObject=0x378) returned 1 [0235.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0235.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx", lpFilePart=0x0) returned 0x23 [0235.098] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BG9j.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bg9j.xlsx")) returned 1 [0235.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0235.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx.jcrypt", lpFilePart=0x0) returned 0x39 [0235.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0235.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\c02ledr_gxgzy4xb4y4.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0235.106] GetFileType (hFile=0x378) returned 0x1 [0235.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0235.106] GetFileType (hFile=0x378) returned 0x1 [0236.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0236.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", lpFilePart=0x0) returned 0x32 [0236.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0236.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c02ledr_gxgzy4xb4y4.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0236.638] GetFileType (hFile=0x3f4) returned 0x1 [0236.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0236.638] GetFileType (hFile=0x3f4) returned 0x1 [0236.640] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b9370, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b9370*, lpNumberOfBytesRead=0x55e7f8*=0x1552b, lpOverlapped=0x0) returned 1 [0236.688] WriteFile (in: hFile=0x378, lpBuffer=0x250072c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x250072c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0236.689] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x14540, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e7d0*=0x14540, lpOverlapped=0x0) returned 1 [0236.691] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b9370, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36b9370*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0236.693] CloseHandle (hObject=0x3f4) returned 1 [0236.693] WriteFile (in: hFile=0x378, lpBuffer=0x250072c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x250072c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0236.693] CloseHandle (hObject=0x378) returned 1 [0236.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0236.696] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx", lpFilePart=0x0) returned 0x32 [0236.696] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\c02Ledr_gXGZy4xb4Y4.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\c02ledr_gxgzy4xb4y4.pptx")) returned 1 [0236.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0236.840] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp.jcrypt", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp.jcrypt", lpFilePart=0x0) returned 0x2d [0236.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0236.840] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\cd3smnbx.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0236.841] GetFileType (hFile=0x378) returned 0x1 [0236.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0236.841] GetFileType (hFile=0x378) returned 0x1 [0238.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0238.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", nBufferLength=0x27, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", lpFilePart=0x0) returned 0x26 [0238.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0238.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp" (normalized: "c:\\users\\fd1hvy\\documents\\cd3smnbx.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0238.159] GetFileType (hFile=0x3f4) returned 0x1 [0238.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0238.159] GetFileType (hFile=0x3f4) returned 0x1 [0238.162] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b5aa0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34b5aa0*, lpNumberOfBytesRead=0x55e7f8*=0x75ea, lpOverlapped=0x0) returned 1 [0238.164] WriteFile (in: hFile=0x378, lpBuffer=0x23e530c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23e530c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0238.165] WriteFile (in: hFile=0x378, lpBuffer=0x23e77d8*, nNumberOfBytesToWrite=0x6600, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23e77d8*, lpNumberOfBytesWritten=0x55e7d0*=0x6600, lpOverlapped=0x0) returned 1 [0238.165] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b5aa0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34b5aa0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0238.165] CloseHandle (hObject=0x3f4) returned 1 [0238.166] WriteFile (in: hFile=0x378, lpBuffer=0x23e530c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23e530c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0238.166] CloseHandle (hObject=0x378) returned 1 [0238.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0238.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", nBufferLength=0x27, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp", lpFilePart=0x0) returned 0x26 [0238.168] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Cd3SMNbx.odp" (normalized: "c:\\users\\fd1hvy\\documents\\cd3smnbx.odp")) returned 1 [0238.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0238.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.jcrypt", lpFilePart=0x0) returned 0x30 [0238.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0238.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0238.193] GetFileType (hFile=0x378) returned 0x1 [0238.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0238.193] GetFileType (hFile=0x378) returned 0x1 [0239.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0239.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0239.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0239.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0239.626] GetFileType (hFile=0x3f4) returned 0x1 [0239.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0239.626] GetFileType (hFile=0x3f4) returned 0x1 [0239.629] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5ac0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b5ac0*, lpNumberOfBytesRead=0x55e7f8*=0x55000, lpOverlapped=0x0) returned 1 [0239.661] WriteFile (in: hFile=0x378, lpBuffer=0x24cff3c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24cff3c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0239.662] WriteFile (in: hFile=0x378, lpBuffer=0x37ba370*, nNumberOfBytesToWrite=0x54020, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x37ba370*, lpNumberOfBytesWritten=0x55e7d0*=0x54020, lpOverlapped=0x0) returned 1 [0239.668] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5ac0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35b5ac0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0239.668] CloseHandle (hObject=0x3f4) returned 1 [0239.668] WriteFile (in: hFile=0x378, lpBuffer=0x24cff3c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24cff3c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0239.668] CloseHandle (hObject=0x378) returned 1 [0239.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0239.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0239.677] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 1 [0239.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0239.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.jcrypt", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x2c [0239.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0239.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0239.731] GetFileType (hFile=0x378) returned 0x1 [0239.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0239.732] GetFileType (hFile=0x378) returned 0x1 [0241.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0241.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x26, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0241.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0241.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0241.169] GetFileType (hFile=0x3f4) returned 0x1 [0241.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0241.169] GetFileType (hFile=0x3f4) returned 0x1 [0241.175] ReadFile (in: hFile=0x3f4, lpBuffer=0x380e3b0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x380e3b0*, lpNumberOfBytesRead=0x55e7f8*=0x192, lpOverlapped=0x0) returned 1 [0241.189] ReadFile (in: hFile=0x3f4, lpBuffer=0x380e3b0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x380e3b0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0241.189] CloseHandle (hObject=0x3f4) returned 1 [0241.190] WriteFile (in: hFile=0x378, lpBuffer=0x23b4d18*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23b4d18*, lpNumberOfBytesWritten=0x55e798*=0x1c0, lpOverlapped=0x0) returned 1 [0241.191] CloseHandle (hObject=0x378) returned 1 [0241.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0241.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini", nBufferLength=0x26, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x25 [0241.192] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini")) returned 1 [0241.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0241.194] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx.jcrypt", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx.jcrypt", lpFilePart=0x0) returned 0x2e [0241.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0241.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\f1fytmwo.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0241.196] GetFileType (hFile=0x378) returned 0x1 [0241.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0241.197] GetFileType (hFile=0x378) returned 0x1 [0242.272] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0242.272] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", lpFilePart=0x0) returned 0x27 [0242.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0242.272] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f1fytmwo.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0242.272] GetFileType (hFile=0x3f4) returned 0x1 [0242.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0242.273] GetFileType (hFile=0x3f4) returned 0x1 [0242.276] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xc11c, lpOverlapped=0x0) returned 1 [0242.288] WriteFile (in: hFile=0x378, lpBuffer=0x249bb5c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x249bb5c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0242.289] WriteFile (in: hFile=0x378, lpBuffer=0x249e028*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x249e028*, lpNumberOfBytesWritten=0x55e7d0*=0xb130, lpOverlapped=0x0) returned 1 [0242.290] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0242.290] CloseHandle (hObject=0x3f4) returned 1 [0242.290] WriteFile (in: hFile=0x378, lpBuffer=0x249bb5c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x249bb5c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0242.291] CloseHandle (hObject=0x378) returned 1 [0242.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0242.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx", lpFilePart=0x0) returned 0x27 [0242.293] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\F1FyTmwO.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\f1fytmwo.xlsx")) returned 1 [0242.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0242.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx.jcrypt", nBufferLength=0x2b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx.jcrypt", lpFilePart=0x0) returned 0x2a [0242.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0242.296] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\fmlo.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0242.297] GetFileType (hFile=0x378) returned 0x1 [0242.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0242.297] GetFileType (hFile=0x378) returned 0x1 [0243.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0243.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", lpFilePart=0x0) returned 0x23 [0243.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0243.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmlo.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0243.769] GetFileType (hFile=0x3f4) returned 0x1 [0243.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0243.769] GetFileType (hFile=0x3f4) returned 0x1 [0243.772] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x128ce, lpOverlapped=0x0) returned 1 [0243.793] WriteFile (in: hFile=0x378, lpBuffer=0x238b37c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x238b37c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0243.794] WriteFile (in: hFile=0x378, lpBuffer=0x238d840*, nNumberOfBytesToWrite=0x118e0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x238d840*, lpNumberOfBytesWritten=0x55e7d0*=0x118e0, lpOverlapped=0x0) returned 1 [0243.796] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0243.796] CloseHandle (hObject=0x3f4) returned 1 [0243.796] WriteFile (in: hFile=0x378, lpBuffer=0x238b37c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x238b37c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0243.796] CloseHandle (hObject=0x378) returned 1 [0243.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0243.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx", lpFilePart=0x0) returned 0x23 [0243.800] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FMlO.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmlo.pptx")) returned 1 [0243.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0243.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx.jcrypt", lpFilePart=0x0) returned 0x39 [0243.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0243.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\gjlgum9 _ee85bqcuui.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0243.807] GetFileType (hFile=0x378) returned 0x1 [0243.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0243.807] GetFileType (hFile=0x378) returned 0x1 [0245.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0245.208] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", lpFilePart=0x0) returned 0x32 [0245.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0245.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\gjlgum9 _ee85bqcuui.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0245.223] GetFileType (hFile=0x3f4) returned 0x1 [0245.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0245.224] GetFileType (hFile=0x3f4) returned 0x1 [0245.227] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x3370, lpOverlapped=0x0) returned 1 [0245.243] WriteFile (in: hFile=0x378, lpBuffer=0x24814dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24814dc*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0245.244] WriteFile (in: hFile=0x378, lpBuffer=0x24839c0*, nNumberOfBytesToWrite=0x2390, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24839c0*, lpNumberOfBytesWritten=0x55e7d0*=0x2390, lpOverlapped=0x0) returned 1 [0245.244] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0245.245] CloseHandle (hObject=0x3f4) returned 1 [0245.245] WriteFile (in: hFile=0x378, lpBuffer=0x24814dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24814dc*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0245.245] CloseHandle (hObject=0x378) returned 1 [0245.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0245.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx", lpFilePart=0x0) returned 0x32 [0245.247] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\gjlGum9 _Ee85bqcuUI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\gjlgum9 _ee85bqcuui.docx")) returned 1 [0245.251] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0245.252] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx.jcrypt", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx.jcrypt", lpFilePart=0x0) returned 0x2b [0245.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0245.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\gzhhv.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0245.252] GetFileType (hFile=0x378) returned 0x1 [0245.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0245.252] GetFileType (hFile=0x378) returned 0x1 [0247.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0247.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", lpFilePart=0x0) returned 0x24 [0247.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0247.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx" (normalized: "c:\\users\\fd1hvy\\documents\\gzhhv.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0247.041] GetFileType (hFile=0x3f4) returned 0x1 [0247.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0247.041] GetFileType (hFile=0x3f4) returned 0x1 [0247.045] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x6bfa, lpOverlapped=0x0) returned 1 [0247.066] WriteFile (in: hFile=0x378, lpBuffer=0x256b65c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x256b65c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0247.068] WriteFile (in: hFile=0x378, lpBuffer=0x256db24*, nNumberOfBytesToWrite=0x5c10, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x256db24*, lpNumberOfBytesWritten=0x55e7d0*=0x5c10, lpOverlapped=0x0) returned 1 [0247.069] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0247.069] CloseHandle (hObject=0x3f4) returned 1 [0247.069] WriteFile (in: hFile=0x378, lpBuffer=0x256b65c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x256b65c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0247.069] CloseHandle (hObject=0x378) returned 1 [0247.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0247.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx", lpFilePart=0x0) returned 0x24 [0247.075] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Gzhhv.docx" (normalized: "c:\\users\\fd1hvy\\documents\\gzhhv.docx")) returned 1 [0247.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0247.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps.jcrypt", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps.jcrypt", lpFilePart=0x0) returned 0x2b [0247.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0247.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\hsyh_j.pps.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0247.081] GetFileType (hFile=0x378) returned 0x1 [0247.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0247.081] GetFileType (hFile=0x378) returned 0x1 [0248.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0248.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", lpFilePart=0x0) returned 0x24 [0248.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0248.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps" (normalized: "c:\\users\\fd1hvy\\documents\\hsyh_j.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0248.749] GetFileType (hFile=0x3f4) returned 0x1 [0248.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0248.749] GetFileType (hFile=0x3f4) returned 0x1 [0248.752] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0xe4b6, lpOverlapped=0x0) returned 1 [0248.767] WriteFile (in: hFile=0x378, lpBuffer=0x2455ab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2455ab0*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0248.768] WriteFile (in: hFile=0x378, lpBuffer=0x2457f78*, nNumberOfBytesToWrite=0xd4d0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2457f78*, lpNumberOfBytesWritten=0x55e7d0*=0xd4d0, lpOverlapped=0x0) returned 1 [0248.769] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0248.769] CloseHandle (hObject=0x3f4) returned 1 [0248.769] WriteFile (in: hFile=0x378, lpBuffer=0x2455ab0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2455ab0*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0248.769] CloseHandle (hObject=0x378) returned 1 [0248.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0248.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", nBufferLength=0x25, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps", lpFilePart=0x0) returned 0x24 [0248.772] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hSyH_j.pps" (normalized: "c:\\users\\fd1hvy\\documents\\hsyh_j.pps")) returned 1 [0248.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0248.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx.jcrypt", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx.jcrypt", lpFilePart=0x0) returned 0x32 [0248.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0248.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\iyxtlnvoniny.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0248.776] GetFileType (hFile=0x378) returned 0x1 [0248.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0248.776] GetFileType (hFile=0x378) returned 0x1 [0250.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0250.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", lpFilePart=0x0) returned 0x2b [0250.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0250.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx" (normalized: "c:\\users\\fd1hvy\\documents\\iyxtlnvoniny.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0250.175] GetFileType (hFile=0x3f4) returned 0x1 [0250.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0250.176] GetFileType (hFile=0x3f4) returned 0x1 [0250.180] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x13d3b, lpOverlapped=0x0) returned 1 [0250.201] WriteFile (in: hFile=0x378, lpBuffer=0x254789c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x254789c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0250.203] WriteFile (in: hFile=0x378, lpBuffer=0x2549d70*, nNumberOfBytesToWrite=0x12d50, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2549d70*, lpNumberOfBytesWritten=0x55e7d0*=0x12d50, lpOverlapped=0x0) returned 1 [0250.205] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0250.205] CloseHandle (hObject=0x3f4) returned 1 [0250.205] WriteFile (in: hFile=0x378, lpBuffer=0x254789c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x254789c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0250.205] CloseHandle (hObject=0x378) returned 1 [0250.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0250.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx", lpFilePart=0x0) returned 0x2b [0250.213] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iYXTlnvoNiNy.docx" (normalized: "c:\\users\\fd1hvy\\documents\\iyxtlnvoniny.docx")) returned 1 [0250.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0250.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf.jcrypt", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf.jcrypt", lpFilePart=0x0) returned 0x2c [0250.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0250.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\jdlzaks.rtf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0250.219] GetFileType (hFile=0x378) returned 0x1 [0250.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0250.219] GetFileType (hFile=0x378) returned 0x1 [0251.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0251.312] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", nBufferLength=0x26, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", lpFilePart=0x0) returned 0x25 [0251.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0251.312] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\jdlzaks.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0251.312] GetFileType (hFile=0x3f4) returned 0x1 [0251.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0251.312] GetFileType (hFile=0x3f4) returned 0x1 [0251.315] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xf878, lpOverlapped=0x0) returned 1 [0251.328] WriteFile (in: hFile=0x378, lpBuffer=0x243fab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x243fab4*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0251.329] WriteFile (in: hFile=0x378, lpBuffer=0x2441f7c*, nNumberOfBytesToWrite=0xe890, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2441f7c*, lpNumberOfBytesWritten=0x55e7d0*=0xe890, lpOverlapped=0x0) returned 1 [0251.330] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0251.330] CloseHandle (hObject=0x3f4) returned 1 [0251.331] WriteFile (in: hFile=0x378, lpBuffer=0x243fab4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x243fab4*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0251.331] CloseHandle (hObject=0x378) returned 1 [0251.333] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0251.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", nBufferLength=0x26, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf", lpFilePart=0x0) returned 0x25 [0251.334] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jDLzaKs.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\jdlzaks.rtf")) returned 1 [0251.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0251.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx.jcrypt", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx.jcrypt", lpFilePart=0x0) returned 0x34 [0251.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0251.338] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\mdxbgsuyusvold.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0251.338] GetFileType (hFile=0x378) returned 0x1 [0251.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0251.339] GetFileType (hFile=0x378) returned 0x1 [0252.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0252.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", lpFilePart=0x0) returned 0x2d [0252.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0252.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mdxbgsuyusvold.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0252.581] GetFileType (hFile=0x3f4) returned 0x1 [0252.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0252.582] GetFileType (hFile=0x3f4) returned 0x1 [0252.585] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x11e38, lpOverlapped=0x0) returned 1 [0252.603] WriteFile (in: hFile=0x378, lpBuffer=0x2532cf8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2532cf8*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0252.607] WriteFile (in: hFile=0x378, lpBuffer=0x25351d0*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x25351d0*, lpNumberOfBytesWritten=0x55e7d0*=0x10e50, lpOverlapped=0x0) returned 1 [0252.608] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0252.609] CloseHandle (hObject=0x3f4) returned 1 [0252.609] WriteFile (in: hFile=0x378, lpBuffer=0x2532cf8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2532cf8*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0252.609] CloseHandle (hObject=0x378) returned 1 [0252.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0252.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx", lpFilePart=0x0) returned 0x2d [0252.611] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mDxbgSUyUSVOLd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\mdxbgsuyusvold.xlsx")) returned 1 [0252.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0252.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps.jcrypt", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps.jcrypt", lpFilePart=0x0) returned 0x30 [0252.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0252.615] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\p2mporksx0l.pps.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0252.616] GetFileType (hFile=0x378) returned 0x1 [0252.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0252.616] GetFileType (hFile=0x378) returned 0x1 [0253.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0253.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", lpFilePart=0x0) returned 0x29 [0253.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0253.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps" (normalized: "c:\\users\\fd1hvy\\documents\\p2mporksx0l.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0253.978] GetFileType (hFile=0x3f4) returned 0x1 [0253.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0253.979] GetFileType (hFile=0x3f4) returned 0x1 [0253.981] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x15e0c, lpOverlapped=0x0) returned 1 [0254.049] WriteFile (in: hFile=0x378, lpBuffer=0x2428544*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x2428544*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0254.050] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x14e20, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e7d0*=0x14e20, lpOverlapped=0x0) returned 1 [0254.052] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0254.056] CloseHandle (hObject=0x3f4) returned 1 [0254.056] WriteFile (in: hFile=0x378, lpBuffer=0x2428544*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x2428544*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0254.056] CloseHandle (hObject=0x378) returned 1 [0254.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0254.060] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", nBufferLength=0x2a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps", lpFilePart=0x0) returned 0x29 [0254.060] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\P2MPoRKsx0l.pps" (normalized: "c:\\users\\fd1hvy\\documents\\p2mporksx0l.pps")) returned 1 [0254.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0254.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx.jcrypt", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx.jcrypt", lpFilePart=0x0) returned 0x2e [0254.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0254.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\pwafdbok.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0254.066] GetFileType (hFile=0x378) returned 0x1 [0254.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0254.066] GetFileType (hFile=0x378) returned 0x1 [0255.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0255.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", lpFilePart=0x0) returned 0x27 [0255.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0255.073] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pwafdbok.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0255.073] GetFileType (hFile=0x3f4) returned 0x1 [0255.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0255.073] GetFileType (hFile=0x3f4) returned 0x1 [0255.078] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6380, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34b6380*, lpNumberOfBytesRead=0x55e7f8*=0x445f, lpOverlapped=0x0) returned 1 [0255.079] WriteFile (in: hFile=0x378, lpBuffer=0x250d110*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x250d110*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0255.081] WriteFile (in: hFile=0x378, lpBuffer=0x250f5dc*, nNumberOfBytesToWrite=0x3470, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x250f5dc*, lpNumberOfBytesWritten=0x55e7d0*=0x3470, lpOverlapped=0x0) returned 1 [0255.081] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6380, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34b6380*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0255.081] CloseHandle (hObject=0x3f4) returned 1 [0255.081] WriteFile (in: hFile=0x378, lpBuffer=0x250d110*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x250d110*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0255.081] CloseHandle (hObject=0x378) returned 1 [0255.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0255.109] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx", lpFilePart=0x0) returned 0x27 [0255.109] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pwafdbOk.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pwafdbok.docx")) returned 1 [0255.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0255.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx.jcrypt", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx.jcrypt", lpFilePart=0x0) returned 0x37 [0255.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0255.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\r2bfzdnyzrms2oqqw.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0255.113] GetFileType (hFile=0x378) returned 0x1 [0255.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0255.113] GetFileType (hFile=0x378) returned 0x1 [0256.257] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0256.257] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", lpFilePart=0x0) returned 0x30 [0256.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0256.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx" (normalized: "c:\\users\\fd1hvy\\documents\\r2bfzdnyzrms2oqqw.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0256.257] GetFileType (hFile=0x3f4) returned 0x1 [0256.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0256.257] GetFileType (hFile=0x3f4) returned 0x1 [0256.260] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e7f8*=0x8b4, lpOverlapped=0x0) returned 1 [0256.273] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0256.274] CloseHandle (hObject=0x3f4) returned 1 [0256.274] WriteFile (in: hFile=0x378, lpBuffer=0x23f502c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23f502c*, lpNumberOfBytesWritten=0x55e798*=0x8e0, lpOverlapped=0x0) returned 1 [0256.275] CloseHandle (hObject=0x378) returned 1 [0256.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0256.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx", lpFilePart=0x0) returned 0x30 [0256.277] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\R2BfZDNyzrms2OQqw.docx" (normalized: "c:\\users\\fd1hvy\\documents\\r2bfzdnyzrms2oqqw.docx")) returned 1 [0256.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0256.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx.jcrypt", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx.jcrypt", lpFilePart=0x0) returned 0x37 [0256.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0256.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\rw-i958r_yaehkgr7.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0256.282] GetFileType (hFile=0x378) returned 0x1 [0256.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0256.282] GetFileType (hFile=0x378) returned 0x1 [0257.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0257.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", lpFilePart=0x0) returned 0x30 [0257.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0257.327] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rw-i958r_yaehkgr7.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0257.328] GetFileType (hFile=0x3f4) returned 0x1 [0257.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0257.328] GetFileType (hFile=0x3f4) returned 0x1 [0257.331] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e7f8*=0xd6fe, lpOverlapped=0x0) returned 1 [0257.349] WriteFile (in: hFile=0x378, lpBuffer=0x24d9458*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24d9458*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0257.351] WriteFile (in: hFile=0x378, lpBuffer=0x24db938*, nNumberOfBytesToWrite=0xc710, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24db938*, lpNumberOfBytesWritten=0x55e7d0*=0xc710, lpOverlapped=0x0) returned 1 [0257.352] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0257.352] CloseHandle (hObject=0x3f4) returned 1 [0257.353] WriteFile (in: hFile=0x378, lpBuffer=0x24d9458*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24d9458*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0257.353] CloseHandle (hObject=0x378) returned 1 [0257.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0257.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", nBufferLength=0x31, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx", lpFilePart=0x0) returned 0x30 [0257.356] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RW-I958R_YAEhKgr7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\rw-i958r_yaehkgr7.pptx")) returned 1 [0257.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0257.361] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps.jcrypt", nBufferLength=0x2f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps.jcrypt", lpFilePart=0x0) returned 0x2e [0257.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0257.361] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\sf9wy2b71.pps.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0257.362] GetFileType (hFile=0x378) returned 0x1 [0257.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0257.362] GetFileType (hFile=0x378) returned 0x1 [0258.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0258.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", lpFilePart=0x0) returned 0x27 [0258.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0258.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sf9wy2b71.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0258.877] GetFileType (hFile=0x3f4) returned 0x1 [0258.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0258.877] GetFileType (hFile=0x3f4) returned 0x1 [0258.880] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x11031, lpOverlapped=0x0) returned 1 [0258.895] WriteFile (in: hFile=0x378, lpBuffer=0x23cba9c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23cba9c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0258.896] WriteFile (in: hFile=0x378, lpBuffer=0x23cdf68*, nNumberOfBytesToWrite=0x10050, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23cdf68*, lpNumberOfBytesWritten=0x55e7d0*=0x10050, lpOverlapped=0x0) returned 1 [0258.898] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0258.898] CloseHandle (hObject=0x3f4) returned 1 [0258.898] WriteFile (in: hFile=0x378, lpBuffer=0x23cba9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23cba9c*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0258.898] CloseHandle (hObject=0x378) returned 1 [0258.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0258.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps", lpFilePart=0x0) returned 0x27 [0258.905] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SF9WY2B71.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sf9wy2b71.pps")) returned 1 [0258.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0258.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx.jcrypt", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx.jcrypt", lpFilePart=0x0) returned 0x2d [0258.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0258.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\wjii77j.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0258.912] GetFileType (hFile=0x378) returned 0x1 [0258.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0258.912] GetFileType (hFile=0x378) returned 0x1 [0260.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0260.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", nBufferLength=0x27, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", lpFilePart=0x0) returned 0x26 [0260.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0260.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wjii77j.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0260.151] GetFileType (hFile=0x3f4) returned 0x1 [0260.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0260.151] GetFileType (hFile=0x3f4) returned 0x1 [0260.154] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x4208, lpOverlapped=0x0) returned 1 [0260.168] WriteFile (in: hFile=0x378, lpBuffer=0x24c0658*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24c0658*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0260.169] WriteFile (in: hFile=0x378, lpBuffer=0x24c2b24*, nNumberOfBytesToWrite=0x3220, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x24c2b24*, lpNumberOfBytesWritten=0x55e7d0*=0x3220, lpOverlapped=0x0) returned 1 [0260.169] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0260.170] CloseHandle (hObject=0x3f4) returned 1 [0260.170] WriteFile (in: hFile=0x378, lpBuffer=0x24c0658*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x24c0658*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0260.170] CloseHandle (hObject=0x378) returned 1 [0260.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0260.171] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", nBufferLength=0x27, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx", lpFilePart=0x0) returned 0x26 [0260.171] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\wJIi77j.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\wjii77j.xlsx")) returned 1 [0260.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0260.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf.jcrypt", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf.jcrypt", lpFilePart=0x0) returned 0x34 [0260.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0260.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\y mk8du6lt_hcv-.rtf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0260.175] GetFileType (hFile=0x378) returned 0x1 [0260.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0260.175] GetFileType (hFile=0x378) returned 0x1 [0261.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0261.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", lpFilePart=0x0) returned 0x2d [0261.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0261.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\y mk8du6lt_hcv-.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0261.255] GetFileType (hFile=0x3f4) returned 0x1 [0261.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0261.255] GetFileType (hFile=0x3f4) returned 0x1 [0261.258] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x1f5e, lpOverlapped=0x0) returned 1 [0261.275] WriteFile (in: hFile=0x378, lpBuffer=0x23a849c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x23a849c*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0261.276] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0261.276] CloseHandle (hObject=0x3f4) returned 1 [0261.277] WriteFile (in: hFile=0x378, lpBuffer=0x23a849c*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x23a849c*, lpNumberOfBytesWritten=0x55e798*=0xf80, lpOverlapped=0x0) returned 1 [0261.277] CloseHandle (hObject=0x378) returned 1 [0261.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0261.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", nBufferLength=0x2e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf", lpFilePart=0x0) returned 0x2d [0261.278] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y mk8du6Lt_hcV-.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\y mk8du6lt_hcv-.rtf")) returned 1 [0261.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0261.282] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt", nBufferLength=0x3b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt", lpFilePart=0x0) returned 0x3a [0261.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0261.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\_8klsgjp-ebcj8bmjskn.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0261.282] GetFileType (hFile=0x378) returned 0x1 [0261.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0261.283] GetFileType (hFile=0x378) returned 0x1 [0262.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0262.373] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", lpFilePart=0x0) returned 0x33 [0262.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e744) returned 1 [0262.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\_8klsgjp-ebcj8bmjskn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0262.373] GetFileType (hFile=0x3f4) returned 0x1 [0262.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e740) returned 1 [0262.373] GetFileType (hFile=0x3f4) returned 0x1 [0262.376] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0xb3b9, lpOverlapped=0x0) returned 1 [0262.389] WriteFile (in: hFile=0x378, lpBuffer=0x248e3a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x248e3a8*, lpNumberOfBytesWritten=0x55e7d0*=0x1000, lpOverlapped=0x0) returned 1 [0262.390] WriteFile (in: hFile=0x378, lpBuffer=0x249088c*, nNumberOfBytesToWrite=0xa3d0, lpNumberOfBytesWritten=0x55e7d0, lpOverlapped=0x0 | out: lpBuffer=0x249088c*, lpNumberOfBytesWritten=0x55e7d0*=0xa3d0, lpOverlapped=0x0) returned 1 [0262.392] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e7f8, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e7f8*=0x0, lpOverlapped=0x0) returned 1 [0262.392] CloseHandle (hObject=0x3f4) returned 1 [0262.392] WriteFile (in: hFile=0x378, lpBuffer=0x248e3a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e798, lpOverlapped=0x0 | out: lpBuffer=0x248e3a8*, lpNumberOfBytesWritten=0x55e798*=0x10, lpOverlapped=0x0) returned 1 [0262.392] CloseHandle (hObject=0x378) returned 1 [0262.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0262.395] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx", lpFilePart=0x0) returned 0x33 [0262.395] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_8kLSgjP-Ebcj8bmjSKn.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\_8klsgjp-ebcj8bmjskn.xlsx")) returned 1 [0262.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e8cc) returned 1 [0262.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0262.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0262.398] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x55e5f4 | out: lpFindFileData=0x55e5f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x26e5f3d6, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2bddd8f2, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e2a8 [0262.398] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x26e5f3d6, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2bddd8f2, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.398] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13835f87, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x13835f87, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1545eea0, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NfmAFsZPq_z.doc.jcrypt", cAlternateFileName="-NFMAF~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x154fdc10, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x154fdc10, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x16f57820, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x3c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BdAogwesXfT1I405G1.xlsx.jcrypt", cAlternateFileName="4BDAOG~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ff01a4, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x16ff01a4, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x18aca145, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x42f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 Pw2hm5wA.rtf.jcrypt", cAlternateFileName="5PW2HM~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18af04a9, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x18af04a9, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x19a95ba1, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="50rlfcTzJyiex7_.pptx.jcrypt", cAlternateFileName="50RLFC~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19ae1fe5, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x19ae1fe5, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1a82e3be, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x11080, dwReserved0=0x0, dwReserved1=0x0, cFileName="a-wGo AGT.pptx.jcrypt", cAlternateFileName="A-WGOA~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a8544da, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1a8544da, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1b965f9c, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x18de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG9j.xlsx.jcrypt", cAlternateFileName="BG9JXL~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b98c1b2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1b98c1b2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1c8bf105, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x15550, dwReserved0=0x0, dwReserved1=0x0, cFileName="c02Ledr_gXGZy4xb4Y4.pptx.jcrypt", cAlternateFileName="C02LED~1.JCR")) returned 1 [0262.399] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca165cf, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1ca165cf, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1d6a9714, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x7610, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cd3SMNbx.odp.jcrypt", cAlternateFileName="CD3SMN~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6f5aac, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1d6f5aac, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1e51dac1, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x55030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb.jcrypt", cAlternateFileName="DATABA~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e5b6368, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1e5b6368, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1f391f7b, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x4eaa2250, ftLastWriteTime.dwHighDateTime=0x1d5e51e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E4FJy", cAlternateFileName="")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f391f7b, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1f391f7b, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x1fe00293, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xc140, dwReserved0=0x0, dwReserved1=0x0, cFileName="F1FyTmwO.xlsx.jcrypt", cAlternateFileName="F1FYTM~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe26638, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x1fe26638, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x20c795b8, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x128f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FMlO.pptx.jcrypt", cAlternateFileName="FMLOPP~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20c795b8, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x20c795b8, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x21a3b1fd, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x33a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gjlGum9 _Ee85bqcuUI.docx.jcrypt", cAlternateFileName="GJLGUM~1.JCR")) returned 1 [0262.400] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21a3b1fd, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x21a3b1fd, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x22baa70e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x6c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gzhhv.docx.jcrypt", cAlternateFileName="GZHHVD~1.JCR")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22baa70e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x22baa70e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x23bc9ad0, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hSyH_j.pps.jcrypt", cAlternateFileName="HSYH_J~1.JCR")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23befd65, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x23befd65, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x249ac74d, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x13d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="iYXTlnvoNiNy.docx.jcrypt", cAlternateFileName="IYXTLN~1.JCR")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249ac74d, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x249ac74d, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x25439ab1, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xf8a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jDLzaKs.rtf.jcrypt", cAlternateFileName="JDLZAK~1.JCR")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2545ff1d, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2545ff1d, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x26072199, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x11e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mDxbgSUyUSVOLd.xlsx.jcrypt", cAlternateFileName="MDXBGS~1.JCR")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0262.401] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26072199, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x26072199, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x26e39037, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x15e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="P2MPoRKsx0l.pps.jcrypt", cAlternateFileName="P2MPOR~1.JCR")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26e5f3d6, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x26e5f3d6, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x27842b52, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x4480, dwReserved0=0x0, dwReserved1=0x0, cFileName="pwafdbOk.docx.jcrypt", cAlternateFileName="PWAFDB~1.JCR")) returned 1 [0262.402] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27842b52, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x27842b52, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2836fb98, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2BfZDNyzrms2OQqw.docx.jcrypt", cAlternateFileName="R2BFZD~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2836fb98, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2836fb98, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x28db7ddb, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xd720, dwReserved0=0x0, dwReserved1=0x0, cFileName="RW-I958R_YAEhKgr7.pptx.jcrypt", cAlternateFileName="RW-I95~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28db7ddb, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x28db7ddb, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x29c7da47, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x11060, dwReserved0=0x0, dwReserved1=0x0, cFileName="SF9WY2B71.pps.jcrypt", cAlternateFileName="SF9WY2~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c7da47, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x29c7da47, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2a88e957, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x4230, dwReserved0=0x0, dwReserved1=0x0, cFileName="wJIi77j.xlsx.jcrypt", cAlternateFileName="WJII77~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a88e957, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2a88e957, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2b323036, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x1f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y mk8du6Lt_hcV-.rtf.jcrypt", cAlternateFileName="YMK8DU~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b323036, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2b323036, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2bdb7764, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xb3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt", cAlternateFileName="_8KLSG~1.JCR")) returned 1 [0262.403] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e600 | out: lpFindFileData=0x55e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b323036, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2b323036, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2bdb7764, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xb3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_8kLSgjP-Ebcj8bmjSKn.xlsx.jcrypt", cAlternateFileName="_8KLSG~1.JCR")) returned 0 [0262.403] FindClose (in: hFindFile=0x76e2a8 | out: hFindFile=0x76e2a8) returned 1 [0262.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e888) returned 1 [0262.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e894) returned 1 [0262.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0262.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0262.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy", nBufferLength=0x20, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy", lpFilePart=0x0) returned 0x1f [0262.404] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x4eaa2250, ftLastWriteTime.dwHighDateTime=0x1d5e51e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e2a8 [0262.404] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x4eaa2250, ftLastWriteTime.dwHighDateTime=0x1d5e51e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.404] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x71a0a240, ftLastWriteTime.dwHighDateTime=0x1d5eebd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="45zW0fA4vU Ca6HCIUG", cAlternateFileName="45ZW0F~1")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52f80e20, ftCreationTime.dwHighDateTime=0x1d5e7db, ftLastAccessTime.dwLowDateTime=0x5dea1eb0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x5dea1eb0, ftLastWriteTime.dwHighDateTime=0x1d5e108, nFileSizeHigh=0x0, nFileSizeLow=0xe8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="9HOg7Qvo.ots", cAlternateFileName="")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1e30, ftCreationTime.dwHighDateTime=0x1d5e214, ftLastAccessTime.dwLowDateTime=0x3b9ff20, ftLastAccessTime.dwHighDateTime=0x1d5eeda, ftLastWriteTime.dwLowDateTime=0x3b9ff20, ftLastWriteTime.dwHighDateTime=0x1d5eeda, nFileSizeHigh=0x0, nFileSizeLow=0x188fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="a2ORU-m.rtf", cAlternateFileName="")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47f500, ftCreationTime.dwHighDateTime=0x1d5e444, ftLastAccessTime.dwLowDateTime=0xaf6a69e0, ftLastAccessTime.dwHighDateTime=0x1d5ecff, ftLastWriteTime.dwLowDateTime=0xaf6a69e0, ftLastWriteTime.dwHighDateTime=0x1d5ecff, nFileSizeHigh=0x0, nFileSizeLow=0x153af, dwReserved0=0x0, dwReserved1=0x0, cFileName="DsN0QHJj3yvcaFMDtxvL.ots", cAlternateFileName="DSN0QH~1.OTS")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aba530, ftCreationTime.dwHighDateTime=0x1d5eec4, ftLastAccessTime.dwLowDateTime=0x13fb8220, ftLastAccessTime.dwHighDateTime=0x1d5ec26, ftLastWriteTime.dwLowDateTime=0x13fb8220, ftLastWriteTime.dwHighDateTime=0x1d5ec26, nFileSizeHigh=0x0, nFileSizeLow=0x1070e, dwReserved0=0x0, dwReserved1=0x0, cFileName="K958l-gmyNZkTre.xlsx", cAlternateFileName="K958L-~1.XLS")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24d8650, ftCreationTime.dwHighDateTime=0x1d5e7ed, ftLastAccessTime.dwLowDateTime=0x25325110, ftLastAccessTime.dwHighDateTime=0x1d5e9b3, ftLastWriteTime.dwLowDateTime=0x25325110, ftLastWriteTime.dwHighDateTime=0x1d5e9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1538b, dwReserved0=0x0, dwReserved1=0x0, cFileName="naJHMT6vCuHMZmL-V.odp", cAlternateFileName="NAJHMT~1.ODP")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d12f3e0, ftCreationTime.dwHighDateTime=0x1d5e4be, ftLastAccessTime.dwLowDateTime=0xa3b17220, ftLastAccessTime.dwHighDateTime=0x1d5e574, ftLastWriteTime.dwLowDateTime=0xa3b17220, ftLastWriteTime.dwHighDateTime=0x1d5e574, nFileSizeHigh=0x0, nFileSizeLow=0xc612, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3SOUM5XwTMTKSLPF.odp", cAlternateFileName="X3SOUM~1.ODP")) returned 1 [0262.405] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0262.406] FindClose (in: hFindFile=0x76e2a8 | out: hFindFile=0x76e2a8) returned 1 [0262.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0262.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0262.406] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0262.407] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots.jcrypt", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots.jcrypt", lpFilePart=0x0) returned 0x33 [0262.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0262.407] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\9hog7qvo.ots.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0262.407] GetFileType (hFile=0x378) returned 0x1 [0262.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0262.407] GetFileType (hFile=0x378) returned 0x1 [0263.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0263.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", lpFilePart=0x0) returned 0x2c [0263.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0263.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\9hog7qvo.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0263.488] GetFileType (hFile=0x3f4) returned 0x1 [0263.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0263.488] GetFileType (hFile=0x3f4) returned 0x1 [0263.492] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0xe8dd, lpOverlapped=0x0) returned 1 [0263.510] WriteFile (in: hFile=0x378, lpBuffer=0x258181c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x258181c*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0263.511] WriteFile (in: hFile=0x378, lpBuffer=0x2583ce8*, nNumberOfBytesToWrite=0xd8f0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2583ce8*, lpNumberOfBytesWritten=0x55e76c*=0xd8f0, lpOverlapped=0x0) returned 1 [0263.513] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0263.513] CloseHandle (hObject=0x3f4) returned 1 [0263.534] WriteFile (in: hFile=0x378, lpBuffer=0x238b3e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x238b3e0*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0263.534] CloseHandle (hObject=0x378) returned 1 [0263.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0263.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots", lpFilePart=0x0) returned 0x2c [0263.537] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\9HOg7Qvo.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\9hog7qvo.ots")) returned 1 [0263.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0263.543] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf.jcrypt", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf.jcrypt", lpFilePart=0x0) returned 0x32 [0263.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0263.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\a2oru-m.rtf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0263.543] GetFileType (hFile=0x378) returned 0x1 [0263.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0263.544] GetFileType (hFile=0x378) returned 0x1 [0264.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0264.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", lpFilePart=0x0) returned 0x2b [0264.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0264.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\a2oru-m.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0264.740] GetFileType (hFile=0x3f4) returned 0x1 [0264.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0264.740] GetFileType (hFile=0x3f4) returned 0x1 [0264.743] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x188fa, lpOverlapped=0x0) returned 1 [0264.785] WriteFile (in: hFile=0x378, lpBuffer=0x246dc28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x246dc28*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0264.787] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x17910, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e76c*=0x17910, lpOverlapped=0x0) returned 1 [0264.789] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0264.792] CloseHandle (hObject=0x3f4) returned 1 [0264.792] WriteFile (in: hFile=0x378, lpBuffer=0x246dc28*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x246dc28*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0264.792] CloseHandle (hObject=0x378) returned 1 [0264.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0264.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", nBufferLength=0x2c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf", lpFilePart=0x0) returned 0x2b [0264.796] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\a2ORU-m.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\a2oru-m.rtf")) returned 1 [0264.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0264.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots.jcrypt", nBufferLength=0x40, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots.jcrypt", lpFilePart=0x0) returned 0x3f [0264.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0264.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\dsn0qhjj3yvcafmdtxvl.ots.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0264.808] GetFileType (hFile=0x378) returned 0x1 [0264.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0264.808] GetFileType (hFile=0x378) returned 0x1 [0265.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0265.734] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", nBufferLength=0x39, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", lpFilePart=0x0) returned 0x38 [0265.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0265.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\dsn0qhjj3yvcafmdtxvl.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0265.734] GetFileType (hFile=0x3f4) returned 0x1 [0265.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0265.735] GetFileType (hFile=0x3f4) returned 0x1 [0265.738] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b8e70, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b8e70*, lpNumberOfBytesRead=0x55e794*=0x153af, lpOverlapped=0x0) returned 1 [0265.743] WriteFile (in: hFile=0x378, lpBuffer=0x2551da4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2551da4*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0265.744] WriteFile (in: hFile=0x378, lpBuffer=0x35b9e70*, nNumberOfBytesToWrite=0x143c0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x35b9e70*, lpNumberOfBytesWritten=0x55e76c*=0x143c0, lpOverlapped=0x0) returned 1 [0265.746] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b8e70, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b8e70*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0265.746] CloseHandle (hObject=0x3f4) returned 1 [0265.747] WriteFile (in: hFile=0x378, lpBuffer=0x2551da4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2551da4*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0265.747] CloseHandle (hObject=0x378) returned 1 [0265.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0265.750] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", nBufferLength=0x39, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots", lpFilePart=0x0) returned 0x38 [0265.750] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\DsN0QHJj3yvcaFMDtxvL.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\dsn0qhjj3yvcafmdtxvl.ots")) returned 1 [0265.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0265.756] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx.jcrypt", nBufferLength=0x3c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx.jcrypt", lpFilePart=0x0) returned 0x3b [0265.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0265.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\k958l-gmynzktre.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0265.757] GetFileType (hFile=0x378) returned 0x1 [0265.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0265.757] GetFileType (hFile=0x378) returned 0x1 [0267.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0267.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", lpFilePart=0x0) returned 0x34 [0267.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0267.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\k958l-gmynzktre.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0267.033] GetFileType (hFile=0x3f4) returned 0x1 [0267.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0267.033] GetFileType (hFile=0x3f4) returned 0x1 [0267.036] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0x1070e, lpOverlapped=0x0) returned 1 [0267.051] WriteFile (in: hFile=0x378, lpBuffer=0x2435c04*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x2435c04*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0267.054] WriteFile (in: hFile=0x378, lpBuffer=0x24380e0*, nNumberOfBytesToWrite=0xf720, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x24380e0*, lpNumberOfBytesWritten=0x55e76c*=0xf720, lpOverlapped=0x0) returned 1 [0267.055] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0267.055] CloseHandle (hObject=0x3f4) returned 1 [0267.055] WriteFile (in: hFile=0x378, lpBuffer=0x2435c04*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x2435c04*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0267.055] CloseHandle (hObject=0x378) returned 1 [0267.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0267.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", nBufferLength=0x35, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx", lpFilePart=0x0) returned 0x34 [0267.058] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\K958l-gmyNZkTre.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\k958l-gmynzktre.xlsx")) returned 1 [0267.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0267.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp.jcrypt", nBufferLength=0x3d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp.jcrypt", lpFilePart=0x0) returned 0x3c [0267.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0267.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\najhmt6vcuhmzml-v.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0267.062] GetFileType (hFile=0x378) returned 0x1 [0267.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0267.062] GetFileType (hFile=0x378) returned 0x1 [0268.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0268.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", lpFilePart=0x0) returned 0x35 [0268.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0268.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\najhmt6vcuhmzml-v.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0268.045] GetFileType (hFile=0x3f4) returned 0x1 [0268.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0268.046] GetFileType (hFile=0x3f4) returned 0x1 [0268.048] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e794*=0x1538b, lpOverlapped=0x0) returned 1 [0268.097] WriteFile (in: hFile=0x378, lpBuffer=0x252a1dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x252a1dc*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0268.099] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x143a0, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e76c*=0x143a0, lpOverlapped=0x0) returned 1 [0268.100] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0268.103] CloseHandle (hObject=0x3f4) returned 1 [0268.104] WriteFile (in: hFile=0x378, lpBuffer=0x252a1dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x252a1dc*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0268.104] CloseHandle (hObject=0x378) returned 1 [0268.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0268.107] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp", lpFilePart=0x0) returned 0x35 [0268.107] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\naJHMT6vCuHMZmL-V.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\najhmt6vcuhmzml-v.odp")) returned 1 [0268.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0268.112] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp.jcrypt", nBufferLength=0x3d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp.jcrypt", lpFilePart=0x0) returned 0x3c [0268.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0268.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\x3soum5xwtmtkslpf.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0268.113] GetFileType (hFile=0x378) returned 0x1 [0268.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0268.113] GetFileType (hFile=0x378) returned 0x1 [0269.149] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0269.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", lpFilePart=0x0) returned 0x35 [0269.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0269.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\x3soum5xwtmtkslpf.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0269.150] GetFileType (hFile=0x3f4) returned 0x1 [0269.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0269.150] GetFileType (hFile=0x3f4) returned 0x1 [0269.154] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b5900, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b5900*, lpNumberOfBytesRead=0x55e794*=0xc612, lpOverlapped=0x0) returned 1 [0269.156] WriteFile (in: hFile=0x378, lpBuffer=0x240ffa0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x240ffa0*, lpNumberOfBytesWritten=0x55e76c*=0x1000, lpOverlapped=0x0) returned 1 [0269.157] WriteFile (in: hFile=0x378, lpBuffer=0x241247c*, nNumberOfBytesToWrite=0xb630, lpNumberOfBytesWritten=0x55e76c, lpOverlapped=0x0 | out: lpBuffer=0x241247c*, lpNumberOfBytesWritten=0x55e76c*=0xb630, lpOverlapped=0x0) returned 1 [0269.158] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b5900, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x34b5900*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0269.158] CloseHandle (hObject=0x3f4) returned 1 [0269.159] WriteFile (in: hFile=0x378, lpBuffer=0x240ffa0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x240ffa0*, lpNumberOfBytesWritten=0x55e734*=0x10, lpOverlapped=0x0) returned 1 [0269.159] CloseHandle (hObject=0x378) returned 1 [0269.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0269.161] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", nBufferLength=0x36, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp", lpFilePart=0x0) returned 0x35 [0269.161] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\x3SOUM5XwTMTKSLPF.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\x3soum5xwtmtkslpf.odp")) returned 1 [0269.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0269.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0269.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy", nBufferLength=0x20, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy", lpFilePart=0x0) returned 0x1f [0269.187] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x2fe8ea7a, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dfe8 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x900e5990, ftCreationTime.dwHighDateTime=0x1d5ea15, ftLastAccessTime.dwLowDateTime=0x4eaa2250, ftLastAccessTime.dwHighDateTime=0x1d5e51e, ftLastWriteTime.dwLowDateTime=0x2fe8ea7a, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x71a0a240, ftLastWriteTime.dwHighDateTime=0x1d5eebd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="45zW0fA4vU Ca6HCIUG", cAlternateFileName="45ZW0F~1")) returned 1 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bddd8f2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2bddd8f2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2c8aa559, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xe900, dwReserved0=0x0, dwReserved1=0x0, cFileName="9HOg7Qvo.ots.jcrypt", cAlternateFileName="9HOG7Q~1.JCR")) returned 1 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c8aa559, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2c8aa559, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2d4a7048, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x18920, dwReserved0=0x0, dwReserved1=0x0, cFileName="a2ORU-m.rtf.jcrypt", cAlternateFileName="A2ORU-~1.JCR")) returned 1 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4cd284, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2d4cd284, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2ddbe054, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x153d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DsN0QHJj3yvcaFMDtxvL.ots.jcrypt", cAlternateFileName="DSN0QH~1.JCR")) returned 1 [0269.188] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dde41b0, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2dde41b0, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2ea42553, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10730, dwReserved0=0x0, dwReserved1=0x0, cFileName="K958l-gmyNZkTre.xlsx.jcrypt", cAlternateFileName="K958L-~1.JCR")) returned 1 [0269.189] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea42553, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2ea42553, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2f4421e9, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x153b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="naJHMT6vCuHMZmL-V.odp.jcrypt", cAlternateFileName="NAJHMT~1.JCR")) returned 1 [0269.189] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4421e9, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2f4421e9, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2fe3df95, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xc640, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3SOUM5XwTMTKSLPF.odp.jcrypt", cAlternateFileName="X3SOUM~1.JCR")) returned 1 [0269.189] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4421e9, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2f4421e9, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x2fe3df95, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xc640, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3SOUM5XwTMTKSLPF.odp.jcrypt", cAlternateFileName="X3SOUM~1.JCR")) returned 0 [0269.189] FindClose (in: hFindFile=0x76dfe8 | out: hFindFile=0x76dfe8) returned 1 [0269.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0269.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0269.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e804) returned 1 [0269.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0269.190] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", lpFilePart=0x0) returned 0x33 [0269.190] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\*", lpFindFileData=0x55e52c | out: lpFindFileData=0x55e52c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x71a0a240, ftLastWriteTime.dwHighDateTime=0x1d5eebd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e5a8 [0269.190] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x71a0a240, ftLastWriteTime.dwHighDateTime=0x1d5eebd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0269.190] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5448c880, ftCreationTime.dwHighDateTime=0x1d5e7c4, ftLastAccessTime.dwLowDateTime=0x528b7550, ftLastAccessTime.dwHighDateTime=0x1d5e8ba, ftLastWriteTime.dwLowDateTime=0x528b7550, ftLastWriteTime.dwHighDateTime=0x1d5e8ba, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZCoSfi9aHv3nxat.ots", cAlternateFileName="-ZCOSF~1.OTS")) returned 1 [0269.190] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb547ca0, ftCreationTime.dwHighDateTime=0x1d5efa8, ftLastAccessTime.dwLowDateTime=0x32d4d380, ftLastAccessTime.dwHighDateTime=0x1d5e9a2, ftLastWriteTime.dwLowDateTime=0x32d4d380, ftLastWriteTime.dwHighDateTime=0x1d5e9a2, nFileSizeHigh=0x0, nFileSizeLow=0x8e69, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jU_CaTcI-H.ppt", cAlternateFileName="6JU_CA~1.PPT")) returned 1 [0269.190] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x5d36bbd0, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpFN15-nC 1m7", cAlternateFileName="CPFN15~1")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ec91d0, ftCreationTime.dwHighDateTime=0x1d5ed65, ftLastAccessTime.dwLowDateTime=0xa82092f0, ftLastAccessTime.dwHighDateTime=0x1d5e920, ftLastWriteTime.dwLowDateTime=0xa82092f0, ftLastWriteTime.dwHighDateTime=0x1d5e920, nFileSizeHigh=0x0, nFileSizeLow=0x574a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JZDvMWcBq.pps", cAlternateFileName="JZDVMW~1.PPS")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449c7940, ftCreationTime.dwHighDateTime=0x1d5e0b7, ftLastAccessTime.dwLowDateTime=0xd3a50540, ftLastAccessTime.dwHighDateTime=0x1d5e1e7, ftLastWriteTime.dwLowDateTime=0xd3a50540, ftLastWriteTime.dwHighDateTime=0x1d5e1e7, nFileSizeHigh=0x0, nFileSizeLow=0xd192, dwReserved0=0x0, dwReserved1=0x0, cFileName="lh w.docx", cAlternateFileName="LHW~1.DOC")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809f8790, ftCreationTime.dwHighDateTime=0x1d5e9a2, ftLastAccessTime.dwLowDateTime=0x9c94a1b0, ftLastAccessTime.dwHighDateTime=0x1d5e0b0, ftLastWriteTime.dwLowDateTime=0x9c94a1b0, ftLastWriteTime.dwHighDateTime=0x1d5e0b0, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mekfDw-S2.odt", cAlternateFileName="MEKFDW~1.ODT")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c69b40, ftCreationTime.dwHighDateTime=0x1d5e98d, ftLastAccessTime.dwLowDateTime=0xd1781c80, ftLastAccessTime.dwHighDateTime=0x1d5e1ce, ftLastWriteTime.dwLowDateTime=0xd1781c80, ftLastWriteTime.dwHighDateTime=0x1d5e1ce, nFileSizeHigh=0x0, nFileSizeLow=0x5b51, dwReserved0=0x0, dwReserved1=0x0, cFileName="oxfEj043P3khkhGCEmHR.xls", cAlternateFileName="OXFEJ0~1.XLS")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0612e00, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x93f3abb0, ftLastAccessTime.dwHighDateTime=0x1d5e4d3, ftLastWriteTime.dwLowDateTime=0x93f3abb0, ftLastWriteTime.dwHighDateTime=0x1d5e4d3, nFileSizeHigh=0x0, nFileSizeLow=0xfcab, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZmrW.csv", cAlternateFileName="")) returned 1 [0269.191] FindNextFileW (in: hFindFile=0x76e5a8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0269.192] FindClose (in: hFindFile=0x76e5a8 | out: hFindFile=0x76e5a8) returned 1 [0269.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7c0) returned 1 [0269.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7cc) returned 1 [0269.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0269.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots.jcrypt", nBufferLength=0x50, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots.jcrypt", lpFilePart=0x0) returned 0x4f [0269.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0269.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\-zcosfi9ahv3nxat.ots.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0269.193] GetFileType (hFile=0x378) returned 0x1 [0269.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0269.193] GetFileType (hFile=0x378) returned 0x1 [0270.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0270.254] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", nBufferLength=0x49, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", lpFilePart=0x0) returned 0x48 [0270.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0270.254] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\-zcosfi9ahv3nxat.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0270.254] GetFileType (hFile=0x3f4) returned 0x1 [0270.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0270.255] GetFileType (hFile=0x3f4) returned 0x1 [0270.259] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5920, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35b5920*, lpNumberOfBytesRead=0x55e730*=0x7992, lpOverlapped=0x0) returned 1 [0270.261] WriteFile (in: hFile=0x378, lpBuffer=0x2502efc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x2502efc*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0270.262] WriteFile (in: hFile=0x378, lpBuffer=0x25053d8*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x25053d8*, lpNumberOfBytesWritten=0x55e708*=0x69b0, lpOverlapped=0x0) returned 1 [0270.263] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5920, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35b5920*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0270.263] CloseHandle (hObject=0x3f4) returned 1 [0270.263] WriteFile (in: hFile=0x378, lpBuffer=0x2502efc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x2502efc*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0270.263] CloseHandle (hObject=0x378) returned 1 [0270.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0270.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", nBufferLength=0x49, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots", lpFilePart=0x0) returned 0x48 [0270.265] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\-ZCoSfi9aHv3nxat.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\-zcosfi9ahv3nxat.ots")) returned 1 [0270.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0270.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt.jcrypt", nBufferLength=0x4b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt.jcrypt", lpFilePart=0x0) returned 0x4a [0270.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0270.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\6ju_catci-h.ppt.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0270.269] GetFileType (hFile=0x378) returned 0x1 [0270.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0270.269] GetFileType (hFile=0x378) returned 0x1 [0271.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0271.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", nBufferLength=0x44, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", lpFilePart=0x0) returned 0x43 [0271.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0271.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\6ju_catci-h.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0271.199] GetFileType (hFile=0x3f4) returned 0x1 [0271.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0271.199] GetFileType (hFile=0x3f4) returned 0x1 [0271.203] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b5940, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x36b5940*, lpNumberOfBytesRead=0x55e730*=0x8e69, lpOverlapped=0x0) returned 1 [0271.205] WriteFile (in: hFile=0x378, lpBuffer=0x23ee90c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x23ee90c*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0271.207] WriteFile (in: hFile=0x378, lpBuffer=0x23f0ddc*, nNumberOfBytesToWrite=0x7e80, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x23f0ddc*, lpNumberOfBytesWritten=0x55e708*=0x7e80, lpOverlapped=0x0) returned 1 [0271.208] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b5940, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x36b5940*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0271.208] CloseHandle (hObject=0x3f4) returned 1 [0271.208] WriteFile (in: hFile=0x378, lpBuffer=0x23ee90c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x23ee90c*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0271.208] CloseHandle (hObject=0x378) returned 1 [0271.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0271.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", nBufferLength=0x44, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt", lpFilePart=0x0) returned 0x43 [0271.211] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\6jU_CaTcI-H.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\6ju_catci-h.ppt")) returned 1 [0271.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0271.215] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps.jcrypt", nBufferLength=0x49, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps.jcrypt", lpFilePart=0x0) returned 0x48 [0271.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0271.216] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\jzdvmwcbq.pps.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0271.216] GetFileType (hFile=0x378) returned 0x1 [0271.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0271.216] GetFileType (hFile=0x378) returned 0x1 [0271.471] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0272.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0272.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", lpFilePart=0x0) returned 0x41 [0272.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0272.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\jzdvmwcbq.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0272.383] GetFileType (hFile=0x3f4) returned 0x1 [0272.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0272.383] GetFileType (hFile=0x3f4) returned 0x1 [0272.387] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x574a, lpOverlapped=0x0) returned 1 [0272.401] WriteFile (in: hFile=0x378, lpBuffer=0x24dc33c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x24dc33c*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0272.402] WriteFile (in: hFile=0x378, lpBuffer=0x24de808*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x24de808*, lpNumberOfBytesWritten=0x55e708*=0x4760, lpOverlapped=0x0) returned 1 [0272.403] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0272.403] CloseHandle (hObject=0x3f4) returned 1 [0272.403] WriteFile (in: hFile=0x378, lpBuffer=0x24dc33c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x24dc33c*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0272.403] CloseHandle (hObject=0x378) returned 1 [0272.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0272.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps", lpFilePart=0x0) returned 0x41 [0272.409] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\JZDvMWcBq.pps" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\jzdvmwcbq.pps")) returned 1 [0272.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0272.414] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx.jcrypt", nBufferLength=0x45, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx.jcrypt", lpFilePart=0x0) returned 0x44 [0272.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0272.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\lh w.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0272.415] GetFileType (hFile=0x378) returned 0x1 [0272.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0272.415] GetFileType (hFile=0x378) returned 0x1 [0273.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0273.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", nBufferLength=0x3e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", lpFilePart=0x0) returned 0x3d [0273.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0273.794] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\lh w.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0273.794] GetFileType (hFile=0x3f4) returned 0x1 [0273.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0273.794] GetFileType (hFile=0x3f4) returned 0x1 [0273.798] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e730*=0xd192, lpOverlapped=0x0) returned 1 [0273.815] WriteFile (in: hFile=0x378, lpBuffer=0x23c5bf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x23c5bf0*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0273.817] WriteFile (in: hFile=0x378, lpBuffer=0x23c80b4*, nNumberOfBytesToWrite=0xc1b0, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x23c80b4*, lpNumberOfBytesWritten=0x55e708*=0xc1b0, lpOverlapped=0x0) returned 1 [0273.818] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0273.818] CloseHandle (hObject=0x3f4) returned 1 [0273.818] WriteFile (in: hFile=0x378, lpBuffer=0x23c5bf0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x23c5bf0*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0273.818] CloseHandle (hObject=0x378) returned 1 [0273.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0273.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", nBufferLength=0x3e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx", lpFilePart=0x0) returned 0x3d [0273.821] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\lh w.docx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\lh w.docx")) returned 1 [0273.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0273.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt.jcrypt", nBufferLength=0x49, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt.jcrypt", lpFilePart=0x0) returned 0x48 [0273.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0273.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\mekfdw-s2.odt.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0273.829] GetFileType (hFile=0x378) returned 0x1 [0273.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0273.830] GetFileType (hFile=0x378) returned 0x1 [0274.991] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0274.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", lpFilePart=0x0) returned 0x41 [0274.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0274.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\mekfdw-s2.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0274.992] GetFileType (hFile=0x3f4) returned 0x1 [0274.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0274.993] GetFileType (hFile=0x3f4) returned 0x1 [0274.996] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e730*=0x238c, lpOverlapped=0x0) returned 1 [0275.012] WriteFile (in: hFile=0x378, lpBuffer=0x24b6f74*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x24b6f74*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0275.013] WriteFile (in: hFile=0x378, lpBuffer=0x24b9440*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x24b9440*, lpNumberOfBytesWritten=0x55e708*=0x13a0, lpOverlapped=0x0) returned 1 [0275.014] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0275.014] CloseHandle (hObject=0x3f4) returned 1 [0275.014] WriteFile (in: hFile=0x378, lpBuffer=0x24b6f74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x24b6f74*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0275.014] CloseHandle (hObject=0x378) returned 1 [0275.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0275.016] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt", lpFilePart=0x0) returned 0x41 [0275.016] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\mekfDw-S2.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\mekfdw-s2.odt")) returned 1 [0275.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0275.021] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls.jcrypt", nBufferLength=0x54, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls.jcrypt", lpFilePart=0x0) returned 0x53 [0275.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0275.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\oxfej043p3khkhgcemhr.xls.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0275.022] GetFileType (hFile=0x378) returned 0x1 [0275.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0275.022] GetFileType (hFile=0x378) returned 0x1 [0276.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0276.036] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", nBufferLength=0x4d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", lpFilePart=0x0) returned 0x4c [0276.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0276.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\oxfej043p3khkhgcemhr.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0276.037] GetFileType (hFile=0x3f4) returned 0x1 [0276.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0276.037] GetFileType (hFile=0x3f4) returned 0x1 [0276.040] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x5b51, lpOverlapped=0x0) returned 1 [0276.055] WriteFile (in: hFile=0x378, lpBuffer=0x239dbb4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x239dbb4*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0276.056] WriteFile (in: hFile=0x378, lpBuffer=0x23a0098*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x23a0098*, lpNumberOfBytesWritten=0x55e708*=0x4b70, lpOverlapped=0x0) returned 1 [0276.057] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0276.057] CloseHandle (hObject=0x3f4) returned 1 [0276.057] WriteFile (in: hFile=0x378, lpBuffer=0x239dbb4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x239dbb4*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0276.057] CloseHandle (hObject=0x378) returned 1 [0276.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0276.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", nBufferLength=0x4d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls", lpFilePart=0x0) returned 0x4c [0276.059] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\oxfEj043P3khkhGCEmHR.xls" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\oxfej043p3khkhgcemhr.xls")) returned 1 [0276.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0276.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv.jcrypt", nBufferLength=0x44, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv.jcrypt", lpFilePart=0x0) returned 0x43 [0276.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0276.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\zmrw.csv.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0276.064] GetFileType (hFile=0x378) returned 0x1 [0276.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0276.064] GetFileType (hFile=0x378) returned 0x1 [0277.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0277.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", nBufferLength=0x3d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", lpFilePart=0x0) returned 0x3c [0277.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0277.433] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\zmrw.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0277.434] GetFileType (hFile=0x3f4) returned 0x1 [0277.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0277.434] GetFileType (hFile=0x3f4) returned 0x1 [0277.437] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e730*=0xfcab, lpOverlapped=0x0) returned 1 [0277.455] WriteFile (in: hFile=0x378, lpBuffer=0x2487a04*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x2487a04*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0277.459] WriteFile (in: hFile=0x378, lpBuffer=0x2489ec8*, nNumberOfBytesToWrite=0xecc0, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x2489ec8*, lpNumberOfBytesWritten=0x55e708*=0xecc0, lpOverlapped=0x0) returned 1 [0277.461] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0277.461] CloseHandle (hObject=0x3f4) returned 1 [0277.461] WriteFile (in: hFile=0x378, lpBuffer=0x2487a04*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x2487a04*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0277.461] CloseHandle (hObject=0x378) returned 1 [0277.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0277.464] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", nBufferLength=0x3d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv", lpFilePart=0x0) returned 0x3c [0277.464] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\ZmrW.csv" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\zmrw.csv")) returned 1 [0277.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e804) returned 1 [0277.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0277.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", nBufferLength=0x34, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG", lpFilePart=0x0) returned 0x33 [0277.469] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\*", lpFindFileData=0x55e52c | out: lpFindFileData=0x55e52c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x34d7c972, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e328 [0277.470] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9217f40, ftCreationTime.dwHighDateTime=0x1d5e42b, ftLastAccessTime.dwLowDateTime=0x71a0a240, ftLastAccessTime.dwHighDateTime=0x1d5eebd, ftLastWriteTime.dwLowDateTime=0x34d7c972, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.470] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fe8ea7a, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x2fe8ea7a, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x308d2685, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x79c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-ZCoSfi9aHv3nxat.ots.jcrypt", cAlternateFileName="-ZCOSF~1.JCR")) returned 1 [0277.470] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308d2685, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x308d2685, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x311ebc82, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x8e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="6jU_CaTcI-H.ppt.jcrypt", cAlternateFileName="6JU_CA~1.JCR")) returned 1 [0277.470] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x5d36bbd0, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpFN15-nC 1m7", cAlternateFileName="CPFN15~1")) returned 1 [0277.471] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x311ebc82, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x311ebc82, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x31d3c8f3, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x5770, dwReserved0=0x0, dwReserved1=0x0, cFileName="JZDvMWcBq.pps.jcrypt", cAlternateFileName="JZDVMW~1.JCR")) returned 1 [0277.471] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31d62a72, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x31d62a72, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x32ab7b2d, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xd1c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lh w.docx.jcrypt", cAlternateFileName="LHWDOC~1.JCR")) returned 1 [0277.471] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32addc2a, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x32addc2a, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x33617873, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x23b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mekfDw-S2.odt.jcrypt", cAlternateFileName="MEKFDW~1.JCR")) returned 1 [0277.471] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3363da92, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3363da92, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x340135a2, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="oxfEj043P3khkhGCEmHR.xls.jcrypt", cAlternateFileName="OXFEJ0~1.JCR")) returned 1 [0277.471] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340135a2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x340135a2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x34d7c972, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xfcd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZmrW.csv.jcrypt", cAlternateFileName="ZMRWCS~1.JCR")) returned 1 [0277.472] FindNextFileW (in: hFindFile=0x76e328, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x340135a2, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x340135a2, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x34d7c972, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xfcd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZmrW.csv.jcrypt", cAlternateFileName="ZMRWCS~1.JCR")) returned 0 [0277.472] FindClose (in: hFindFile=0x76e328 | out: hFindFile=0x76e328) returned 1 [0277.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7c0) returned 1 [0277.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7cc) returned 1 [0277.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e7a0) returned 1 [0277.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0277.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", lpFilePart=0x0) returned 0x41 [0277.473] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\*", lpFindFileData=0x55e4c8 | out: lpFindFileData=0x55e4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x5d36bbd0, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e4e8 [0277.473] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x5d36bbd0, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0277.473] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d52c980, ftCreationTime.dwHighDateTime=0x1d5e7fa, ftLastAccessTime.dwLowDateTime=0xa1c57b60, ftLastAccessTime.dwHighDateTime=0x1d5eb2c, ftLastWriteTime.dwLowDateTime=0xa1c57b60, ftLastWriteTime.dwHighDateTime=0x1d5eb2c, nFileSizeHigh=0x0, nFileSizeLow=0xe9db, dwReserved0=0x0, dwReserved1=0x0, cFileName="5G6nJ.odp", cAlternateFileName="")) returned 1 [0277.473] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dbd00, ftCreationTime.dwHighDateTime=0x1d5e20f, ftLastAccessTime.dwLowDateTime=0x4a112f70, ftLastAccessTime.dwHighDateTime=0x1d5e5b1, ftLastWriteTime.dwLowDateTime=0x4a112f70, ftLastWriteTime.dwHighDateTime=0x1d5e5b1, nFileSizeHigh=0x0, nFileSizeLow=0x41f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2VqlAymxq-rH_GUk1.odp", cAlternateFileName="A2VQLA~1.ODP")) returned 1 [0277.473] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d606a10, ftCreationTime.dwHighDateTime=0x1d5e469, ftLastAccessTime.dwLowDateTime=0x6598b320, ftLastAccessTime.dwHighDateTime=0x1d5f025, ftLastWriteTime.dwLowDateTime=0x6598b320, ftLastWriteTime.dwHighDateTime=0x1d5f025, nFileSizeHigh=0x0, nFileSizeLow=0x10559, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScyXdAY.ots", cAlternateFileName="")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc61e14f0, ftCreationTime.dwHighDateTime=0x1d5e739, ftLastAccessTime.dwLowDateTime=0x31a516d0, ftLastAccessTime.dwHighDateTime=0x1d5ee68, ftLastWriteTime.dwLowDateTime=0x31a516d0, ftLastWriteTime.dwHighDateTime=0x1d5ee68, nFileSizeHigh=0x0, nFileSizeLow=0x11da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fdCV-csWoZ.odp", cAlternateFileName="FDCV-C~1.ODP")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x503e52a0, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GpDdy", cAlternateFileName="")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad53840, ftCreationTime.dwHighDateTime=0x1d5e932, ftLastAccessTime.dwLowDateTime=0x81cdef30, ftLastAccessTime.dwHighDateTime=0x1d5e5a1, ftLastWriteTime.dwLowDateTime=0x81cdef30, ftLastWriteTime.dwHighDateTime=0x1d5e5a1, nFileSizeHigh=0x0, nFileSizeLow=0x1555f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIt_WPbB.docx", cAlternateFileName="HIT_WP~1.DOC")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x459be090, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xa9838820, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0xa9838820, ftLastWriteTime.dwHighDateTime=0x1d5efe0, nFileSizeHigh=0x0, nFileSizeLow=0x13a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXNgj4sqwj4kA1rNWim.pptx", cAlternateFileName="OXNGJ4~1.PPT")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de432f0, ftCreationTime.dwHighDateTime=0x1d5e6a7, ftLastAccessTime.dwLowDateTime=0x96478200, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x96478200, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x16518, dwReserved0=0x0, dwReserved1=0x0, cFileName="vJwj52gbptJ6vVAm8.rtf", cAlternateFileName="VJWJ52~1.RTF")) returned 1 [0277.474] FindNextFileW (in: hFindFile=0x76e4e8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0277.475] FindClose (in: hFindFile=0x76e4e8 | out: hFindFile=0x76e4e8) returned 1 [0277.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e75c) returned 1 [0277.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e768) returned 1 [0277.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0277.476] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp.jcrypt", nBufferLength=0x53, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp.jcrypt", lpFilePart=0x0) returned 0x52 [0277.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0277.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\5g6nj.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0277.477] GetFileType (hFile=0x378) returned 0x1 [0277.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0277.477] GetFileType (hFile=0x378) returned 0x1 [0278.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0278.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", nBufferLength=0x4c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", lpFilePart=0x0) returned 0x4b [0278.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0278.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\5g6nj.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0278.611] GetFileType (hFile=0x3f4) returned 0x1 [0278.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0278.611] GetFileType (hFile=0x3f4) returned 0x1 [0278.616] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e6cc*=0xe9db, lpOverlapped=0x0) returned 1 [0278.634] WriteFile (in: hFile=0x378, lpBuffer=0x257ebd4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x257ebd4*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0278.636] WriteFile (in: hFile=0x378, lpBuffer=0x2581098*, nNumberOfBytesToWrite=0xd9f0, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x2581098*, lpNumberOfBytesWritten=0x55e6a4*=0xd9f0, lpOverlapped=0x0) returned 1 [0278.637] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0278.637] CloseHandle (hObject=0x3f4) returned 1 [0278.641] WriteFile (in: hFile=0x378, lpBuffer=0x238c628*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x238c628*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0278.641] CloseHandle (hObject=0x378) returned 1 [0278.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0278.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", nBufferLength=0x4c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp", lpFilePart=0x0) returned 0x4b [0278.665] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\5G6nJ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\5g6nj.odp")) returned 1 [0278.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60 [0278.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp.jcrypt", nBufferLength=0x60, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp.jcrypt", lpFilePart=0x0) returned 0x5f [0278.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0278.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\a2vqlaymxq-rh_guk1.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0278.672] GetFileType (hFile=0x378) returned 0x1 [0278.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0278.672] GetFileType (hFile=0x378) returned 0x1 [0279.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0279.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", nBufferLength=0x59, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", lpFilePart=0x0) returned 0x58 [0279.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0279.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\a2vqlaymxq-rh_guk1.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0279.871] GetFileType (hFile=0x3f4) returned 0x1 [0279.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0279.871] GetFileType (hFile=0x3f4) returned 0x1 [0279.875] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e6cc*=0x41f5, lpOverlapped=0x0) returned 1 [0279.877] WriteFile (in: hFile=0x378, lpBuffer=0x246f6f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x246f6f4*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0279.878] WriteFile (in: hFile=0x378, lpBuffer=0x2471bd4*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x2471bd4*, lpNumberOfBytesWritten=0x55e6a4*=0x3210, lpOverlapped=0x0) returned 1 [0279.878] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0279.879] CloseHandle (hObject=0x3f4) returned 1 [0279.879] WriteFile (in: hFile=0x378, lpBuffer=0x246f6f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x246f6f4*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0279.879] CloseHandle (hObject=0x378) returned 1 [0279.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0279.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", nBufferLength=0x59, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp", lpFilePart=0x0) returned 0x58 [0279.882] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\A2VqlAymxq-rH_GUk1.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\a2vqlaymxq-rh_guk1.odp")) returned 1 [0279.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0279.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots.jcrypt", nBufferLength=0x56, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots.jcrypt", lpFilePart=0x0) returned 0x55 [0279.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0279.888] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\escyxday.ots.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0279.889] GetFileType (hFile=0x378) returned 0x1 [0279.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0279.889] GetFileType (hFile=0x378) returned 0x1 [0280.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0280.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", nBufferLength=0x4f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", lpFilePart=0x0) returned 0x4e [0280.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0280.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\escyxday.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0280.902] GetFileType (hFile=0x3f4) returned 0x1 [0280.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0280.902] GetFileType (hFile=0x3f4) returned 0x1 [0280.905] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e6cc*=0x10559, lpOverlapped=0x0) returned 1 [0280.908] WriteFile (in: hFile=0x378, lpBuffer=0x2557e4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x2557e4c*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0280.909] WriteFile (in: hFile=0x378, lpBuffer=0x255a318*, nNumberOfBytesToWrite=0xf570, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x255a318*, lpNumberOfBytesWritten=0x55e6a4*=0xf570, lpOverlapped=0x0) returned 1 [0280.910] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0280.910] CloseHandle (hObject=0x3f4) returned 1 [0280.910] WriteFile (in: hFile=0x378, lpBuffer=0x2557e4c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x2557e4c*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0280.911] CloseHandle (hObject=0x378) returned 1 [0280.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0280.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", nBufferLength=0x4f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots", lpFilePart=0x0) returned 0x4e [0280.913] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\EScyXdAY.ots" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\escyxday.ots")) returned 1 [0280.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0280.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp.jcrypt", nBufferLength=0x58, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp.jcrypt", lpFilePart=0x0) returned 0x57 [0280.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0280.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\fdcv-cswoz.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0280.919] GetFileType (hFile=0x378) returned 0x1 [0280.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0280.919] GetFileType (hFile=0x378) returned 0x1 [0281.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0281.926] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", lpFilePart=0x0) returned 0x50 [0281.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0281.927] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\fdcv-cswoz.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0281.927] GetFileType (hFile=0x3f4) returned 0x1 [0281.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0281.927] GetFileType (hFile=0x3f4) returned 0x1 [0281.930] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e6cc*=0x11da8, lpOverlapped=0x0) returned 1 [0281.946] WriteFile (in: hFile=0x378, lpBuffer=0x244c9a0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x244c9a0*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0281.948] WriteFile (in: hFile=0x378, lpBuffer=0x244ee70*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x244ee70*, lpNumberOfBytesWritten=0x55e6a4*=0x10dc0, lpOverlapped=0x0) returned 1 [0281.949] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0281.949] CloseHandle (hObject=0x3f4) returned 1 [0281.949] WriteFile (in: hFile=0x378, lpBuffer=0x244c9a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x244c9a0*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0281.949] CloseHandle (hObject=0x378) returned 1 [0281.952] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0281.952] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp", lpFilePart=0x0) returned 0x50 [0281.952] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\fdCV-csWoZ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\fdcv-cswoz.odp")) returned 1 [0281.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x57 [0281.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx.jcrypt", nBufferLength=0x57, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx.jcrypt", lpFilePart=0x0) returned 0x56 [0281.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0281.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\hit_wpbb.docx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0281.956] GetFileType (hFile=0x378) returned 0x1 [0281.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0281.956] GetFileType (hFile=0x378) returned 0x1 [0283.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0283.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", nBufferLength=0x50, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", lpFilePart=0x0) returned 0x4f [0283.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0283.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\hit_wpbb.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0283.325] GetFileType (hFile=0x3f4) returned 0x1 [0283.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0283.325] GetFileType (hFile=0x3f4) returned 0x1 [0283.346] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e6cc*=0x1555f, lpOverlapped=0x0) returned 1 [0283.362] WriteFile (in: hFile=0x378, lpBuffer=0x2543904*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x2543904*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0283.363] WriteFile (in: hFile=0x378, lpBuffer=0x35a1560*, nNumberOfBytesToWrite=0x14570, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x35a1560*, lpNumberOfBytesWritten=0x55e6a4*=0x14570, lpOverlapped=0x0) returned 1 [0283.365] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0283.365] CloseHandle (hObject=0x3f4) returned 1 [0283.365] WriteFile (in: hFile=0x378, lpBuffer=0x2543904*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x2543904*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0283.365] CloseHandle (hObject=0x378) returned 1 [0283.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0283.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", nBufferLength=0x50, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx", lpFilePart=0x0) returned 0x4f [0283.371] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\HIt_WPbB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\hit_wpbb.docx")) returned 1 [0283.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0283.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx.jcrypt", nBufferLength=0x62, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx.jcrypt", lpFilePart=0x0) returned 0x61 [0283.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0283.376] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\oxngj4sqwj4ka1rnwim.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0283.376] GetFileType (hFile=0x378) returned 0x1 [0283.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0283.376] GetFileType (hFile=0x378) returned 0x1 [0284.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0284.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", nBufferLength=0x5b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", lpFilePart=0x0) returned 0x5a [0284.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0284.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\oxngj4sqwj4ka1rnwim.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0284.294] GetFileType (hFile=0x3f4) returned 0x1 [0284.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0284.294] GetFileType (hFile=0x3f4) returned 0x1 [0284.298] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5af0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x35b5af0*, lpNumberOfBytesRead=0x55e6cc*=0x13a09, lpOverlapped=0x0) returned 1 [0284.315] WriteFile (in: hFile=0x378, lpBuffer=0x24280bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x24280bc*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0284.316] WriteFile (in: hFile=0x378, lpBuffer=0x242a5a0*, nNumberOfBytesToWrite=0x12a20, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x242a5a0*, lpNumberOfBytesWritten=0x55e6a4*=0x12a20, lpOverlapped=0x0) returned 1 [0284.318] ReadFile (in: hFile=0x3f4, lpBuffer=0x35b5af0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x35b5af0*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0284.318] CloseHandle (hObject=0x3f4) returned 1 [0284.318] WriteFile (in: hFile=0x378, lpBuffer=0x24280bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x24280bc*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0284.318] CloseHandle (hObject=0x378) returned 1 [0284.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0284.321] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", nBufferLength=0x5b, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx", lpFilePart=0x0) returned 0x5a [0284.321] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\oXNgj4sqwj4kA1rNWim.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\oxngj4sqwj4ka1rnwim.pptx")) returned 1 [0284.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0284.325] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf.jcrypt", nBufferLength=0x5f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf.jcrypt", lpFilePart=0x0) returned 0x5e [0284.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0284.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\vjwj52gbptj6vvam8.rtf.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0284.325] GetFileType (hFile=0x378) returned 0x1 [0284.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0284.325] GetFileType (hFile=0x378) returned 0x1 [0285.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0285.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", nBufferLength=0x58, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", lpFilePart=0x0) returned 0x57 [0285.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e618) returned 1 [0285.515] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\vjwj52gbptj6vvam8.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0285.516] GetFileType (hFile=0x3f4) returned 0x1 [0285.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e614) returned 1 [0285.516] GetFileType (hFile=0x3f4) returned 0x1 [0285.527] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b5b10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x36b5b10*, lpNumberOfBytesRead=0x55e6cc*=0x16518, lpOverlapped=0x0) returned 1 [0285.579] WriteFile (in: hFile=0x378, lpBuffer=0x25202f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x25202f4*, lpNumberOfBytesWritten=0x55e6a4*=0x1000, lpOverlapped=0x0) returned 1 [0285.581] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x15530, lpNumberOfBytesWritten=0x55e6a4, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e6a4*=0x15530, lpOverlapped=0x0) returned 1 [0285.582] ReadFile (in: hFile=0x3f4, lpBuffer=0x36b5b10, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e6cc, lpOverlapped=0x0 | out: lpBuffer=0x36b5b10*, lpNumberOfBytesRead=0x55e6cc*=0x0, lpOverlapped=0x0) returned 1 [0285.585] CloseHandle (hObject=0x3f4) returned 1 [0285.585] WriteFile (in: hFile=0x378, lpBuffer=0x25202f4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e66c, lpOverlapped=0x0 | out: lpBuffer=0x25202f4*, lpNumberOfBytesWritten=0x55e66c*=0x10, lpOverlapped=0x0) returned 1 [0285.585] CloseHandle (hObject=0x378) returned 1 [0285.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0285.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", nBufferLength=0x58, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf", lpFilePart=0x0) returned 0x57 [0285.588] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\vJwj52gbptJ6vVAm8.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\vjwj52gbptj6vvam8.rtf")) returned 1 [0285.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e7a0) returned 1 [0285.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0285.591] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", nBufferLength=0x42, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7", lpFilePart=0x0) returned 0x41 [0285.592] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\*", lpFindFileData=0x55e4c8 | out: lpFindFileData=0x55e4c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x39af7699, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e4a8 [0285.592] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc5b246b0, ftCreationTime.dwHighDateTime=0x1d5e72c, ftLastAccessTime.dwLowDateTime=0x5d36bbd0, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x39af7699, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0285.592] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34da2b5a, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x34da2b5a, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x358f90e5, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="5G6nJ.odp.jcrypt", cAlternateFileName="5G6NJO~1.JCR")) returned 1 [0285.592] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358f90e5, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x358f90e5, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x36498be9, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x4220, dwReserved0=0x0, dwReserved1=0x0, cFileName="A2VqlAymxq-rH_GUk1.odp.jcrypt", cAlternateFileName="A2VQLA~1.JCR")) returned 1 [0285.592] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36498be9, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x36498be9, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x36e6e353, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10580, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScyXdAY.ots.jcrypt", cAlternateFileName="ESCYXD~1.JCR")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e6e353, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x36e6e353, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x37843d6e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x11dd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fdCV-csWoZ.odp.jcrypt", cAlternateFileName="FDCV-C~1.JCR")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x503e52a0, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GpDdy", cAlternateFileName="")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37843d6e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x37843d6e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x385c4bc9, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIt_WPbB.docx.jcrypt", cAlternateFileName="HIT_WP~1.JCR")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x385eae75, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x385eae75, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x38edbbfa, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x13a30, dwReserved0=0x0, dwReserved1=0x0, cFileName="oXNgj4sqwj4kA1rNWim.pptx.jcrypt", cAlternateFileName="OXNGJ4~1.JCR")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38edbbfa, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x38edbbfa, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x39af7699, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x16540, dwReserved0=0x0, dwReserved1=0x0, cFileName="vJwj52gbptJ6vVAm8.rtf.jcrypt", cAlternateFileName="VJWJ52~1.JCR")) returned 1 [0285.593] FindNextFileW (in: hFindFile=0x76e4a8, lpFindFileData=0x55e4d4 | out: lpFindFileData=0x55e4d4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38edbbfa, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x38edbbfa, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x39af7699, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x16540, dwReserved0=0x0, dwReserved1=0x0, cFileName="vJwj52gbptJ6vVAm8.rtf.jcrypt", cAlternateFileName="VJWJ52~1.JCR")) returned 0 [0285.593] FindClose (in: hFindFile=0x76e4a8 | out: hFindFile=0x76e4a8) returned 1 [0285.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e75c) returned 1 [0285.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e768) returned 1 [0285.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e73c) returned 1 [0285.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0285.594] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", nBufferLength=0x48, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", lpFilePart=0x0) returned 0x47 [0285.594] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\*", lpFindFileData=0x55e464 | out: lpFindFileData=0x55e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x503e52a0, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e2a8 [0285.594] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x503e52a0, ftLastWriteTime.dwHighDateTime=0x1d5e5e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0fcb90, ftCreationTime.dwHighDateTime=0x1d5e65d, ftLastAccessTime.dwLowDateTime=0xda6e60, ftLastAccessTime.dwHighDateTime=0x1d5e9c2, ftLastWriteTime.dwLowDateTime=0xda6e60, ftLastWriteTime.dwHighDateTime=0x1d5e9c2, nFileSizeHigh=0x0, nFileSizeLow=0x1365f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hFt.odt", cAlternateFileName="")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97da780, ftCreationTime.dwHighDateTime=0x1d5e107, ftLastAccessTime.dwLowDateTime=0x495d1960, ftLastAccessTime.dwHighDateTime=0x1d5e28a, ftLastWriteTime.dwLowDateTime=0x495d1960, ftLastWriteTime.dwHighDateTime=0x1d5e28a, nFileSizeHigh=0x0, nFileSizeLow=0x10603, dwReserved0=0x0, dwReserved1=0x0, cFileName="B4Df-puxZmRH9ptlw.odp", cAlternateFileName="B4DF-P~1.ODP")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95712490, ftCreationTime.dwHighDateTime=0x1d5e960, ftLastAccessTime.dwLowDateTime=0xaabd1aa0, ftLastAccessTime.dwHighDateTime=0x1d5e7be, ftLastWriteTime.dwLowDateTime=0xaabd1aa0, ftLastWriteTime.dwHighDateTime=0x1d5e7be, nFileSizeHigh=0x0, nFileSizeLow=0xc3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBCY2 K6.pptx", cAlternateFileName="EBCY2K~1.PPT")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23e76000, ftCreationTime.dwHighDateTime=0x1d5e83e, ftLastAccessTime.dwLowDateTime=0xa7cfabe0, ftLastAccessTime.dwHighDateTime=0x1d5f007, ftLastWriteTime.dwLowDateTime=0xa7cfabe0, ftLastWriteTime.dwHighDateTime=0x1d5f007, nFileSizeHigh=0x0, nFileSizeLow=0x576d, dwReserved0=0x0, dwReserved1=0x0, cFileName="pIH7NEBTTQo2dWf.odt", cAlternateFileName="PIH7NE~1.ODT")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b04560, ftCreationTime.dwHighDateTime=0x1d5ea6f, ftLastAccessTime.dwLowDateTime=0xbbe04530, ftLastAccessTime.dwHighDateTime=0x1d5ed88, ftLastWriteTime.dwLowDateTime=0xbbe04530, ftLastWriteTime.dwHighDateTime=0x1d5ed88, nFileSizeHigh=0x0, nFileSizeLow=0xfeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="QZ n.doc", cAlternateFileName="QZN~1.DOC")) returned 1 [0285.595] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a3599d0, ftCreationTime.dwHighDateTime=0x1d5ecd6, ftLastAccessTime.dwLowDateTime=0x29b9a250, ftLastAccessTime.dwHighDateTime=0x1d5e59f, ftLastWriteTime.dwLowDateTime=0x29b9a250, ftLastWriteTime.dwHighDateTime=0x1d5e59f, nFileSizeHigh=0x0, nFileSizeLow=0x1619d, dwReserved0=0x0, dwReserved1=0x0, cFileName="YRQqvwBEqiPpZLuQma.xlsx", cAlternateFileName="YRQQVW~1.XLS")) returned 1 [0285.596] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d7c8040, ftCreationTime.dwHighDateTime=0x1d5e44b, ftLastAccessTime.dwLowDateTime=0x18904010, ftLastAccessTime.dwHighDateTime=0x1d5ef95, ftLastWriteTime.dwLowDateTime=0x18904010, ftLastWriteTime.dwHighDateTime=0x1d5ef95, nFileSizeHigh=0x0, nFileSizeLow=0x1004c, dwReserved0=0x0, dwReserved1=0x0, cFileName="_C88c4pdIYtfHMPwk.xlsx", cAlternateFileName="_C88C4~1.XLS")) returned 1 [0285.596] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0285.596] FindClose (in: hFindFile=0x76e2a8 | out: hFindFile=0x76e2a8) returned 1 [0285.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6f8) returned 1 [0285.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e704) returned 1 [0285.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0285.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt.jcrypt", nBufferLength=0x58, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt.jcrypt", lpFilePart=0x0) returned 0x57 [0285.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0285.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\6hft.odt.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0285.598] GetFileType (hFile=0x378) returned 0x1 [0285.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0285.598] GetFileType (hFile=0x378) returned 0x1 [0286.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0286.745] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", lpFilePart=0x0) returned 0x50 [0286.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0286.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\6hft.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0286.745] GetFileType (hFile=0x3f4) returned 0x1 [0286.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0286.746] GetFileType (hFile=0x3f4) returned 0x1 [0286.751] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6a90, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34b6a90*, lpNumberOfBytesRead=0x55e668*=0x1365f, lpOverlapped=0x0) returned 1 [0286.755] WriteFile (in: hFile=0x378, lpBuffer=0x2409210*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x2409210*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0286.757] WriteFile (in: hFile=0x378, lpBuffer=0x240b6d4*, nNumberOfBytesToWrite=0x12670, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x240b6d4*, lpNumberOfBytesWritten=0x55e640*=0x12670, lpOverlapped=0x0) returned 1 [0286.758] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6a90, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34b6a90*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0286.758] CloseHandle (hObject=0x3f4) returned 1 [0286.759] WriteFile (in: hFile=0x378, lpBuffer=0x2409210*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x2409210*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0286.759] CloseHandle (hObject=0x378) returned 1 [0286.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0286.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt", lpFilePart=0x0) returned 0x50 [0286.762] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\6hFt.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\6hft.odt")) returned 1 [0286.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0286.766] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp.jcrypt", nBufferLength=0x65, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp.jcrypt", lpFilePart=0x0) returned 0x64 [0286.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0286.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\b4df-puxzmrh9ptlw.odp.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0286.767] GetFileType (hFile=0x378) returned 0x1 [0286.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0286.767] GetFileType (hFile=0x378) returned 0x1 [0287.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e [0287.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", nBufferLength=0x5e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", lpFilePart=0x0) returned 0x5d [0287.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0287.811] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\b4df-puxzmrh9ptlw.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0287.811] GetFileType (hFile=0x3f4) returned 0x1 [0287.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0287.811] GetFileType (hFile=0x3f4) returned 0x1 [0287.814] ReadFile (in: hFile=0x3f4, lpBuffer=0x37b5b30, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x37b5b30*, lpNumberOfBytesRead=0x55e668*=0x10603, lpOverlapped=0x0) returned 1 [0287.833] WriteFile (in: hFile=0x378, lpBuffer=0x2501240*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x2501240*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0287.834] WriteFile (in: hFile=0x378, lpBuffer=0x250371c*, nNumberOfBytesToWrite=0xf620, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x250371c*, lpNumberOfBytesWritten=0x55e640*=0xf620, lpOverlapped=0x0) returned 1 [0287.835] ReadFile (in: hFile=0x3f4, lpBuffer=0x37b5b30, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x37b5b30*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0287.835] CloseHandle (hObject=0x3f4) returned 1 [0287.836] WriteFile (in: hFile=0x378, lpBuffer=0x2501240*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x2501240*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0287.836] CloseHandle (hObject=0x378) returned 1 [0287.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5e [0287.839] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", nBufferLength=0x5e, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp", lpFilePart=0x0) returned 0x5d [0287.839] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\B4Df-puxZmRH9ptlw.odp" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\b4df-puxzmrh9ptlw.odp")) returned 1 [0287.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5d [0287.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx.jcrypt", nBufferLength=0x5d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx.jcrypt", lpFilePart=0x0) returned 0x5c [0287.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0287.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\ebcy2 k6.pptx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0287.847] GetFileType (hFile=0x378) returned 0x1 [0287.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0287.847] GetFileType (hFile=0x378) returned 0x1 [0288.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0288.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", nBufferLength=0x56, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", lpFilePart=0x0) returned 0x55 [0288.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0288.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\ebcy2 k6.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0288.996] GetFileType (hFile=0x3f4) returned 0x1 [0288.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0288.996] GetFileType (hFile=0x3f4) returned 0x1 [0288.999] ReadFile (in: hFile=0x3f4, lpBuffer=0x38b5b50, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x38b5b50*, lpNumberOfBytesRead=0x55e668*=0xc3b1, lpOverlapped=0x0) returned 1 [0289.017] WriteFile (in: hFile=0x378, lpBuffer=0x23f6268*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23f6268*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0289.018] WriteFile (in: hFile=0x378, lpBuffer=0x23f8734*, nNumberOfBytesToWrite=0xb3d0, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23f8734*, lpNumberOfBytesWritten=0x55e640*=0xb3d0, lpOverlapped=0x0) returned 1 [0289.019] ReadFile (in: hFile=0x3f4, lpBuffer=0x38b5b50, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x38b5b50*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0289.019] CloseHandle (hObject=0x3f4) returned 1 [0289.020] WriteFile (in: hFile=0x378, lpBuffer=0x23f6268*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x23f6268*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0289.020] CloseHandle (hObject=0x378) returned 1 [0289.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x56 [0289.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", nBufferLength=0x56, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx", lpFilePart=0x0) returned 0x55 [0289.023] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\eBCY2 K6.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\ebcy2 k6.pptx")) returned 1 [0289.026] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x63 [0289.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt.jcrypt", nBufferLength=0x63, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt.jcrypt", lpFilePart=0x0) returned 0x62 [0289.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0289.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\pih7nebttqo2dwf.odt.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0289.027] GetFileType (hFile=0x378) returned 0x1 [0289.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0289.027] GetFileType (hFile=0x378) returned 0x1 [0289.242] SleepEx (dwMilliseconds=0x2, bAlertable=0) returned 0x0 [0290.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0290.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", nBufferLength=0x5c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", lpFilePart=0x0) returned 0x5b [0290.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0290.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\pih7nebttqo2dwf.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0290.055] GetFileType (hFile=0x3f4) returned 0x1 [0290.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0290.056] GetFileType (hFile=0x3f4) returned 0x1 [0290.058] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e668*=0x576d, lpOverlapped=0x0) returned 1 [0290.071] WriteFile (in: hFile=0x378, lpBuffer=0x24e915c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x24e915c*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0290.072] WriteFile (in: hFile=0x378, lpBuffer=0x24eb634*, nNumberOfBytesToWrite=0x4780, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x24eb634*, lpNumberOfBytesWritten=0x55e640*=0x4780, lpOverlapped=0x0) returned 1 [0290.073] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0290.073] CloseHandle (hObject=0x3f4) returned 1 [0290.073] WriteFile (in: hFile=0x378, lpBuffer=0x24e915c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x24e915c*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0290.073] CloseHandle (hObject=0x378) returned 1 [0290.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0290.075] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", nBufferLength=0x5c, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt", lpFilePart=0x0) returned 0x5b [0290.075] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\pIH7NEBTTQo2dWf.odt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\pih7nebttqo2dwf.odt")) returned 1 [0290.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0290.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc.jcrypt", nBufferLength=0x58, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc.jcrypt", lpFilePart=0x0) returned 0x57 [0290.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0290.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\qz n.doc.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0290.080] GetFileType (hFile=0x378) returned 0x1 [0290.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0290.081] GetFileType (hFile=0x378) returned 0x1 [0291.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0291.185] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", lpFilePart=0x0) returned 0x50 [0291.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0291.185] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\qz n.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0291.185] GetFileType (hFile=0x3f4) returned 0x1 [0291.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0291.186] GetFileType (hFile=0x3f4) returned 0x1 [0291.188] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e668*=0xfeda, lpOverlapped=0x0) returned 1 [0291.204] WriteFile (in: hFile=0x378, lpBuffer=0x23d33e8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23d33e8*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0291.206] WriteFile (in: hFile=0x378, lpBuffer=0x23d58ac*, nNumberOfBytesToWrite=0xeef0, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23d58ac*, lpNumberOfBytesWritten=0x55e640*=0xeef0, lpOverlapped=0x0) returned 1 [0291.207] ReadFile (in: hFile=0x3f4, lpBuffer=0x35a0580, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x35a0580*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0291.207] CloseHandle (hObject=0x3f4) returned 1 [0291.208] WriteFile (in: hFile=0x378, lpBuffer=0x23d33e8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x23d33e8*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0291.208] CloseHandle (hObject=0x378) returned 1 [0291.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0291.210] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", nBufferLength=0x51, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc", lpFilePart=0x0) returned 0x50 [0291.210] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\QZ n.doc" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\qz n.doc")) returned 1 [0291.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0291.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx.jcrypt", nBufferLength=0x67, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx.jcrypt", lpFilePart=0x0) returned 0x66 [0291.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0291.213] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\yrqqvwbeqippzluqma.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0291.213] GetFileType (hFile=0x378) returned 0x1 [0291.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0291.213] GetFileType (hFile=0x378) returned 0x1 [0292.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60 [0292.376] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", nBufferLength=0x60, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", lpFilePart=0x0) returned 0x5f [0292.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0292.376] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\yrqqvwbeqippzluqma.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0292.377] GetFileType (hFile=0x3f4) returned 0x1 [0292.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0292.377] GetFileType (hFile=0x3f4) returned 0x1 [0292.380] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e668*=0x1619d, lpOverlapped=0x0) returned 1 [0292.434] WriteFile (in: hFile=0x378, lpBuffer=0x24c7f68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x24c7f68*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0292.435] WriteFile (in: hFile=0x378, lpBuffer=0x34a1540*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x34a1540*, lpNumberOfBytesWritten=0x55e640*=0x151b0, lpOverlapped=0x0) returned 1 [0292.436] ReadFile (in: hFile=0x3f4, lpBuffer=0x36a05a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x36a05a0*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0292.439] CloseHandle (hObject=0x3f4) returned 1 [0292.439] WriteFile (in: hFile=0x378, lpBuffer=0x24c7f68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x24c7f68*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0292.439] CloseHandle (hObject=0x378) returned 1 [0292.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x60 [0292.442] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", nBufferLength=0x60, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx", lpFilePart=0x0) returned 0x5f [0292.442] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\YRQqvwBEqiPpZLuQma.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\yrqqvwbeqippzluqma.xlsx")) returned 1 [0292.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x66 [0292.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx.jcrypt", nBufferLength=0x66, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx.jcrypt", lpFilePart=0x0) returned 0x65 [0292.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0292.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\_c88c4pdiytfhmpwk.xlsx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0292.448] GetFileType (hFile=0x378) returned 0x1 [0292.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0292.448] GetFileType (hFile=0x378) returned 0x1 [0293.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0293.535] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", nBufferLength=0x5f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", lpFilePart=0x0) returned 0x5e [0293.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e5b4) returned 1 [0293.535] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\_c88c4pdiytfhmpwk.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0293.536] GetFileType (hFile=0x3f4) returned 0x1 [0293.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e5b0) returned 1 [0293.536] GetFileType (hFile=0x3f4) returned 0x1 [0293.552] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6710, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34b6710*, lpNumberOfBytesRead=0x55e668*=0x1004c, lpOverlapped=0x0) returned 1 [0293.555] WriteFile (in: hFile=0x378, lpBuffer=0x23acda4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23acda4*, lpNumberOfBytesWritten=0x55e640*=0x1000, lpOverlapped=0x0) returned 1 [0293.556] WriteFile (in: hFile=0x378, lpBuffer=0x23af284*, nNumberOfBytesToWrite=0xf060, lpNumberOfBytesWritten=0x55e640, lpOverlapped=0x0 | out: lpBuffer=0x23af284*, lpNumberOfBytesWritten=0x55e640*=0xf060, lpOverlapped=0x0) returned 1 [0293.557] ReadFile (in: hFile=0x3f4, lpBuffer=0x34b6710, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e668, lpOverlapped=0x0 | out: lpBuffer=0x34b6710*, lpNumberOfBytesRead=0x55e668*=0x0, lpOverlapped=0x0) returned 1 [0293.557] CloseHandle (hObject=0x3f4) returned 1 [0293.557] WriteFile (in: hFile=0x378, lpBuffer=0x23acda4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e608, lpOverlapped=0x0 | out: lpBuffer=0x23acda4*, lpNumberOfBytesWritten=0x55e608*=0x10, lpOverlapped=0x0) returned 1 [0293.557] CloseHandle (hObject=0x378) returned 1 [0293.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5f [0293.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", nBufferLength=0x5f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx", lpFilePart=0x0) returned 0x5e [0293.560] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\_C88c4pdIYtfHMPwk.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\e4fjy\\45zw0fa4vu ca6hciug\\cpfn15-nc 1m7\\gpddy\\_c88c4pdiytfhmpwk.xlsx")) returned 1 [0293.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e73c) returned 1 [0293.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0293.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", nBufferLength=0x48, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy", lpFilePart=0x0) returned 0x47 [0293.576] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\E4FJy\\45zW0fA4vU Ca6HCIUG\\cpFN15-nC 1m7\\GpDdy\\*", lpFindFileData=0x55e464 | out: lpFindFileData=0x55e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x3e711376, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dee8 [0293.577] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaceaa970, ftCreationTime.dwHighDateTime=0x1d5e4d3, ftLastAccessTime.dwLowDateTime=0x503e52a0, ftLastAccessTime.dwHighDateTime=0x1d5e5e9, ftLastWriteTime.dwLowDateTime=0x3e711376, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0293.577] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39b1db86, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x39b1db86, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3a62480e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x13680, dwReserved0=0x0, dwReserved1=0x0, cFileName="6hFt.odt.jcrypt", cAlternateFileName="6HFTOD~1.JCR")) returned 1 [0293.577] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a62480e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3a62480e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3b06cdf3, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10630, dwReserved0=0x0, dwReserved1=0x0, cFileName="B4Df-puxZmRH9ptlw.odp.jcrypt", cAlternateFileName="B4DF-P~1.JCR")) returned 1 [0293.577] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b092dd1, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3b092dd1, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3bbc6650, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xc3e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBCY2 K6.pptx.jcrypt", cAlternateFileName="EBCY2K~1.JCR")) returned 1 [0293.578] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bbc6650, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3bbc6650, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3c5c23b4, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x5790, dwReserved0=0x0, dwReserved1=0x0, cFileName="pIH7NEBTTQo2dWf.odt.jcrypt", cAlternateFileName="PIH7NE~1.JCR")) returned 1 [0293.578] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c5c23b4, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3c5c23b4, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3d0a301e, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0xff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="QZ n.doc.jcrypt", cAlternateFileName="QZNDOC~1.JCR")) returned 1 [0293.578] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0a301e, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3d0a301e, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3dc42870, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x161c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YRQqvwBEqiPpZLuQma.xlsx.jcrypt", cAlternateFileName="YRQQVW~1.JCR")) returned 1 [0293.578] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc68b6a, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3dc68b6a, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3e6eb8eb, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10070, dwReserved0=0x0, dwReserved1=0x0, cFileName="_C88c4pdIYtfHMPwk.xlsx.jcrypt", cAlternateFileName="_C88C4~1.JCR")) returned 1 [0293.578] FindNextFileW (in: hFindFile=0x76dee8, lpFindFileData=0x55e470 | out: lpFindFileData=0x55e470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc68b6a, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3dc68b6a, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3e6eb8eb, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x10070, dwReserved0=0x0, dwReserved1=0x0, cFileName="_C88c4pdIYtfHMPwk.xlsx.jcrypt", cAlternateFileName="_C88C4~1.JCR")) returned 0 [0293.578] FindClose (in: hFindFile=0x76dee8 | out: hFindFile=0x76dee8) returned 1 [0293.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6f8) returned 1 [0293.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e704) returned 1 [0293.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0293.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0293.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x23, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0293.579] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0293.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e82c) returned 1 [0293.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0293.595] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0293.595] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x26, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0293.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0293.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e82c) returned 1 [0293.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0293.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0293.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0293.598] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e2a8 [0293.598] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0293.599] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0293.599] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0293.599] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0293.599] FindNextFileW (in: hFindFile=0x76e2a8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0293.599] FindClose (in: hFindFile=0x76e2a8 | out: hFindFile=0x76e2a8) returned 1 [0293.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0293.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0293.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0293.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.jcrypt", nBufferLength=0x37, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.jcrypt", lpFilePart=0x0) returned 0x36 [0293.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0293.602] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0293.605] GetFileType (hFile=0x378) returned 0x1 [0293.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0293.605] GetFileType (hFile=0x378) returned 0x1 [0294.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0294.826] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x30, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f [0294.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0294.826] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0294.827] GetFileType (hFile=0x3f4) returned 0x1 [0294.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0294.827] GetFileType (hFile=0x3f4) returned 0x1 [0294.844] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0xd8, lpOverlapped=0x0) returned 1 [0294.944] ReadFile (in: hFile=0x3f4, lpBuffer=0x37a05c0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x37a05c0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0294.944] CloseHandle (hObject=0x3f4) returned 1 [0294.945] WriteFile (in: hFile=0x378, lpBuffer=0x24a33bc*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x24a33bc*, lpNumberOfBytesWritten=0x55e734*=0x100, lpOverlapped=0x0) returned 1 [0294.945] CloseHandle (hObject=0x378) returned 1 [0294.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0294.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x30, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x2f [0294.947] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini")) returned 1 [0294.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0294.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.jcrypt", nBufferLength=0x3a, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.jcrypt", lpFilePart=0x0) returned 0x39 [0294.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0294.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0294.949] GetFileType (hFile=0x378) returned 0x1 [0294.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0294.949] GetFileType (hFile=0x378) returned 0x1 [0296.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0296.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32 [0296.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0296.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0296.054] GetFileType (hFile=0x3f4) returned 0x1 [0296.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0296.054] GetFileType (hFile=0x3f4) returned 0x1 [0296.058] ReadFile (in: hFile=0x3f4, lpBuffer=0x38a05e0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e794, lpOverlapped=0x0 | out: lpBuffer=0x38a05e0*, lpNumberOfBytesRead=0x55e794*=0x0, lpOverlapped=0x0) returned 1 [0296.073] CloseHandle (hObject=0x3f4) returned 1 [0296.074] WriteFile (in: hFile=0x378, lpBuffer=0x25881a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x55e734, lpOverlapped=0x0 | out: lpBuffer=0x25881a8*, lpNumberOfBytesWritten=0x55e734*=0x30, lpOverlapped=0x0) returned 1 [0296.165] CloseHandle (hObject=0x378) returned 1 [0296.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0296.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x33, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x32 [0296.167] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx")) returned 1 [0296.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0296.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0296.170] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0296.170] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x3ffde706, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76dfe8 [0296.170] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x3ffde706, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0296.170] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e75d785, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3e75d785, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3f43f211, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.jcrypt", cAlternateFileName="DESKTO~1.JCR")) returned 1 [0296.170] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f43f211, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x3f43f211, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x3ffde706, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x30, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx.jcrypt", cAlternateFileName="FAVORI~1.JCR")) returned 1 [0296.171] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0296.171] FindNextFileW (in: hFindFile=0x76dfe8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0296.172] FindClose (in: hFindFile=0x76dfe8 | out: hFindFile=0x76dfe8) returned 1 [0296.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0296.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0296.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e804) returned 1 [0296.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0296.173] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0296.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x55e52c | out: lpFindFileData=0x55e52c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e468 [0296.175] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0296.182] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0296.182] FindNextFileW (in: hFindFile=0x76e468, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0296.183] FindClose (in: hFindFile=0x76e468 | out: hFindFile=0x76e468) returned 1 [0296.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7c0) returned 1 [0296.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7cc) returned 1 [0296.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0296.184] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.jcrypt", nBufferLength=0x3f, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.jcrypt", lpFilePart=0x0) returned 0x3e [0296.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0296.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0296.185] GetFileType (hFile=0x378) returned 0x1 [0296.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0296.185] GetFileType (hFile=0x378) returned 0x1 [0297.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0297.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0297.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e67c) returned 1 [0297.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f4 [0297.618] GetFileType (hFile=0x3f4) returned 0x1 [0297.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e678) returned 1 [0297.618] GetFileType (hFile=0x3f4) returned 0x1 [0297.621] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x74e6, lpOverlapped=0x0) returned 1 [0297.637] WriteFile (in: hFile=0x378, lpBuffer=0x246ec80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x246ec80*, lpNumberOfBytesWritten=0x55e708*=0x1000, lpOverlapped=0x0) returned 1 [0297.639] WriteFile (in: hFile=0x378, lpBuffer=0x2471148*, nNumberOfBytesToWrite=0x6500, lpNumberOfBytesWritten=0x55e708, lpOverlapped=0x0 | out: lpBuffer=0x2471148*, lpNumberOfBytesWritten=0x55e708*=0x6500, lpOverlapped=0x0) returned 1 [0297.640] ReadFile (in: hFile=0x3f4, lpBuffer=0x34a0560, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x55e730, lpOverlapped=0x0 | out: lpBuffer=0x34a0560*, lpNumberOfBytesRead=0x55e730*=0x0, lpOverlapped=0x0) returned 1 [0297.640] CloseHandle (hObject=0x3f4) returned 1 [0297.640] WriteFile (in: hFile=0x378, lpBuffer=0x246ec80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x55e6d0, lpOverlapped=0x0 | out: lpBuffer=0x246ec80*, lpNumberOfBytesWritten=0x55e6d0*=0x10, lpOverlapped=0x0) returned 1 [0297.640] CloseHandle (hObject=0x378) returned 1 [0297.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0297.642] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x38, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0297.642] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0297.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e804) returned 1 [0297.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0297.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x2d, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0297.644] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x55e52c | out: lpFindFileData=0x55e52c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40de05fd, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e1e8 [0297.644] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x40de05fd, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0297.645] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x400049dd, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x400049dd, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x40de05fd, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x7510, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico.jcrypt", cAlternateFileName="FOLDER~1.JCR")) returned 1 [0297.645] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e538 | out: lpFindFileData=0x55e538*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x400049dd, ftCreationTime.dwHighDateTime=0x1d6d768, ftLastAccessTime.dwLowDateTime=0x400049dd, ftLastAccessTime.dwHighDateTime=0x1d6d768, ftLastWriteTime.dwLowDateTime=0x40de05fd, ftLastWriteTime.dwHighDateTime=0x1d6d768, nFileSizeHigh=0x0, nFileSizeLow=0x7510, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico.jcrypt", cAlternateFileName="FOLDER~1.JCR")) returned 0 [0297.645] FindClose (in: hFindFile=0x76e1e8 | out: hFindFile=0x76e1e8) returned 1 [0297.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7c0) returned 1 [0297.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e7cc) returned 1 [0297.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0297.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0297.646] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x24, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0297.646] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0297.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e82c) returned 1 [0297.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e868) returned 1 [0297.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0297.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x28, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0297.648] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x55e590 | out: lpFindFileData=0x55e590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x76e1e8 [0297.648] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0297.649] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0297.649] FindNextFileW (in: hFindFile=0x76e1e8, lpFindFileData=0x55e59c | out: lpFindFileData=0x55e59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0297.649] FindClose (in: hFindFile=0x76e1e8 | out: hFindFile=0x76e1e8) returned 1 [0297.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e824) returned 1 [0297.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e830) returned 1 [0297.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.jcrypt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0297.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.jcrypt", nBufferLength=0x40, lpBuffer=0x769610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.jcrypt", lpFilePart=0x0) returned 0x3f [0297.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x55e6e0) returned 1 [0297.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.jcrypt" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.jcrypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0297.651] GetFileType (hFile=0x378) returned 0x1 [0297.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x55e6dc) returned 1 [0297.651] GetFileType (hFile=0x378) returned 0x1 Thread: id = 2 os_tid = 0x1174 Thread: id = 3 os_tid = 0x1150 Thread: id = 4 os_tid = 0x114c [0067.306] CoGetContextToken (in: pToken=0x448f534 | out: pToken=0x448f534) returned 0x800401f0 [0067.307] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0067.307] RoInitialize () returned 0x1 [0067.307] RoUninitialize () returned 0x0 [0095.297] CloseHandle (hObject=0x36c) returned 1 [0095.297] CloseHandle (hObject=0x374) returned 1 [0095.297] CloseHandle (hObject=0x368) returned 1 [0095.298] CloseHandle (hObject=0x360) returned 1 [0095.298] CloseHandle (hObject=0x378) returned 1 [0095.298] CloseHandle (hObject=0x364) returned 1 [0095.298] CloseHandle (hObject=0x370) returned 1 [0095.298] CloseHandle (hObject=0x354) returned 1 [0095.298] CloseHandle (hObject=0x37c) returned 1 [0095.299] CloseHandle (hObject=0x35c) returned 1 [0148.490] WriteFile (in: hFile=0x3f4, lpBuffer=0x2379a40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448f464, lpOverlapped=0x0 | out: lpBuffer=0x2379a40*, lpNumberOfBytesWritten=0x448f464*=0x20, lpOverlapped=0x0) returned 1 [0148.492] CloseHandle (hObject=0x3f4) returned 1 Thread: id = 5 os_tid = 0x109c Thread: id = 6 os_tid = 0x53c Thread: id = 7 os_tid = 0xdc8 Thread: id = 8 os_tid = 0xeac