# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 05.07.2020 09:39:08.783 Process: id = "1" image_name = "xx.exe" filename = "c:\\users\\fd1hvy\\desktop\\xx.exe" page_root = "0x11ae4000" os_pid = "0x13d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\xX.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13d4 [0045.880] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0046.465] RoInitialize () returned 0x1 [0046.465] RoUninitialize () returned 0x0 [0049.090] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0xefec50 | out: phkResult=0xefec50*=0x0) returned 0x2 [0049.090] RegCloseKey (hKey=0x80000002) returned 0x0 [0049.098] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0xefeea8, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0049.114] IsAppThemed () returned 0x1 [0049.119] CoTaskMemAlloc (cb=0xf0) returned 0x1257a48 [0049.119] CreateActCtxA (pActCtx=0xeff3f8) returned 0x12580cc [0049.261] CoTaskMemFree (pv=0x1257a48) [0049.275] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0049.275] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc198 [0049.287] GetUserNameW (in: lpBuffer=0xeff220, pcbBuffer=0xeff498 | out: lpBuffer="FD1HVy", pcbBuffer=0xeff498) returned 1 [0049.293] GetComputerNameW (in: lpBuffer=0xeff220, nSize=0xeff498 | out: lpBuffer="NQDPDE", nSize=0xeff498) returned 1 [0050.108] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", nBufferLength=0x105, lpBuffer=0xefecf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", lpFilePart=0x0) returned 0x25 [0050.498] GetCurrentProcess () returned 0xffffffff [0050.498] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff060 | out: TokenHandle=0xeff060*=0x2cc) returned 1 [0050.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0xefeaec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0050.504] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xeff058 | out: lpFileInformation=0xeff058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0050.505] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0xefeab8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0050.505] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xeff060 | out: lpFileInformation=0xeff060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0050.506] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0xefea54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0050.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefef98) returned 1 [0050.507] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0050.507] GetFileType (hFile=0x2d0) returned 0x1 [0050.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefef94) returned 1 [0050.507] GetFileType (hFile=0x2d0) returned 0x1 [0050.541] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0xeff054 | out: lpFileSizeHigh=0xeff054*=0x0) returned 0x8c8f [0050.550] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xeff010, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xeff010*=0x1000, lpOverlapped=0x0) returned 1 [0050.613] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeebc, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefeebc*=0x1000, lpOverlapped=0x0) returned 1 [0050.615] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed70, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefed70*=0x1000, lpOverlapped=0x0) returned 1 [0050.615] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed70, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefed70*=0x1000, lpOverlapped=0x0) returned 1 [0050.616] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed70, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefed70*=0x1000, lpOverlapped=0x0) returned 1 [0050.616] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefeca8, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefeca8*=0x1000, lpOverlapped=0x0) returned 1 [0050.622] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefee2c, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefee2c*=0x1000, lpOverlapped=0x0) returned 1 [0050.624] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed38, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefed38*=0x1000, lpOverlapped=0x0) returned 1 [0050.624] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefed38, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefed38*=0xc8f, lpOverlapped=0x0) returned 1 [0050.624] ReadFile (in: hFile=0x2d0, lpBuffer=0x2d99bb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefedfc, lpOverlapped=0x0 | out: lpBuffer=0x2d99bb0*, lpNumberOfBytesRead=0xefedfc*=0x0, lpOverlapped=0x0) returned 1 [0050.624] CloseHandle (hObject=0x2d0) returned 1 [0050.626] GetCurrentProcess () returned 0xffffffff [0050.626] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff1a8 | out: TokenHandle=0xeff1a8*=0x2d0) returned 1 [0050.626] GetCurrentProcess () returned 0xffffffff [0050.626] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff1a8 | out: TokenHandle=0xeff1a8*=0x2d4) returned 1 [0050.627] GetCurrentProcess () returned 0xffffffff [0050.627] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff060 | out: TokenHandle=0xeff060*=0x2d8) returned 1 [0050.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xeff058 | out: lpFileInformation=0xeff058*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", nBufferLength=0x105, lpBuffer=0xefeab8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", lpFilePart=0x0) returned 0x25 [0050.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xeff060 | out: lpFileInformation=0xeff060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.627] GetCurrentProcess () returned 0xffffffff [0050.627] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff1a8 | out: TokenHandle=0xeff1a8*=0x2dc) returned 1 [0050.628] GetCurrentProcess () returned 0xffffffff [0050.628] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff1a8 | out: TokenHandle=0xeff1a8*=0x2e0) returned 1 [0050.645] GetCurrentProcess () returned 0xffffffff [0050.645] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff008 | out: TokenHandle=0xeff008*=0x2e4) returned 1 [0050.649] GetCurrentProcess () returned 0xffffffff [0050.649] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xeff018 | out: TokenHandle=0xeff018*=0x2e8) returned 1 [0050.710] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0050.713] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0051.288] AdjustWindowRectEx (in: lpRect=0xeff438, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0xeff438) returned 1 [0051.291] GetCurrentProcess () returned 0xffffffff [0051.291] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0xeff34c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0xeff34c*=0x2f0) returned 1 [0051.300] GetCurrentActCtx (in: lphActCtx=0xeff2ac | out: lphActCtx=0xeff2ac*=0x0) returned 1 [0051.300] ActivateActCtx (in: hActCtx=0x12580cc, lpCookie=0xeff2bc | out: hActCtx=0x12580cc, lpCookie=0xeff2bc) returned 1 [0051.300] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0051.302] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0051.917] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0051.918] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0051.919] GetStockObject (i=5) returned 0x900015 [0051.922] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0051.924] CoTaskMemAlloc (cb=0x5a) returned 0x12616e0 [0051.924] RegisterClassW (lpWndClass=0xeff160) returned 0xc197 [0051.925] CoTaskMemFree (pv=0x12616e0) [0051.925] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0051.926] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x302c0 [0051.927] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=1950089536) returned 88933822 [0051.928] GetWindowLongW (hWnd=0x302c0, nIndex=-4) returned 1950089536 [0051.930] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe980 | out: phkResult=0xefe980*=0x308) returned 0x0 [0051.931] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0xefe9a0, lpData=0x0, lpcbData=0xefe99c*=0x0 | out: lpType=0xefe9a0*=0x0, lpData=0x0, lpcbData=0xefe99c*=0x0) returned 0x2 [0051.931] RegQueryValueExW (in: hKey=0x308, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0xefe9a0, lpData=0x0, lpcbData=0xefe99c*=0x0 | out: lpType=0xefe9a0*=0x0, lpData=0x0, lpcbData=0xefe99c*=0x0) returned 0x2 [0051.931] RegCloseKey (hKey=0x308) returned 0x0 [0051.932] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=88933862) returned 1950089536 [0051.932] GetWindowLongW (hWnd=0x302c0, nIndex=-4) returned 88933862 [0051.932] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned 113311744 [0051.933] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc19a [0051.934] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc19b [0051.934] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x81, wParam=0x0, lParam=0xefecd0) returned 0x1 [0051.935] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x83, wParam=0x0, lParam=0xefecbc) returned 0x0 [0052.119] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c0, Msg=0x1, wParam=0x0, lParam=0xefecd0) returned 0x0 [0052.119] GetClientRect (in: hWnd=0x302c0, lpRect=0xefe9b8 | out: lpRect=0xefe9b8) returned 1 [0052.120] GetWindowRect (in: hWnd=0x302c0, lpRect=0xefe9b8 | out: lpRect=0xefe9b8) returned 1 [0052.122] GetParent (hWnd=0x302c0) returned 0x0 [0052.122] DeactivateActCtx (dwFlags=0x0, ulCookie=0x112c0001) returned 1 [0052.156] EtwEventRegister (in: ProviderId=0x2db5e54, EnableCallback=0x54d060e, CallbackContext=0x0, RegHandle=0x2db5e30 | out: RegHandle=0x2db5e30) returned 0x0 [0052.230] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0052.231] AdjustWindowRectEx (in: lpRect=0xeff3e4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff3e4) returned 1 [0052.231] GetSystemMetrics (nIndex=59) returned 1460 [0052.231] GetSystemMetrics (nIndex=60) returned 920 [0052.231] GetSystemMetrics (nIndex=34) returned 136 [0052.231] GetSystemMetrics (nIndex=35) returned 39 [0052.231] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0052.231] AdjustWindowRectEx (in: lpRect=0xeff2e4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff2e4) returned 1 [0052.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", nBufferLength=0x105, lpBuffer=0xefecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config", lpFilePart=0x0) returned 0x25 [0052.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xeff174) returned 1 [0052.236] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe.config"), fInfoLevelId=0x0, lpFileInformation=0xeff1f0 | out: lpFileInformation=0xeff1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0052.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xeff170) returned 1 [0052.712] GetSystemMetrics (nIndex=11) returned 32 [0052.713] GetSystemMetrics (nIndex=12) returned 32 [0052.713] GetDC (hWnd=0x0) returned 0x10105d6 [0052.716] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0052.716] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0052.717] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0052.717] CreateIconFromResourceEx (presbits=0x2dc90a0, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x402ab [0052.726] CreateCompatibleDC (hdc=0x0) returned 0x49010536 [0052.727] GetSystemDefaultLCID () returned 0x409 [0052.727] GetStockObject (i=17) returned 0xa01c1 [0052.729] GetObjectW (in: h=0xa01c1, c=92, pv=0xeff134 | out: pv=0xeff134) returned 92 [0052.729] GetDC (hWnd=0x0) returned 0x10105d6 [0052.805] GdiplusStartup (in: token=0xfe5f18, input=0xefe6e8, output=0xefe738 | out: token=0xfe5f18, output=0xefe738) returned 0x0 [0052.812] CoTaskMemAlloc (cb=0x5c) returned 0x1261610 [0052.813] GdipCreateFontFromLogfontW (hdc=0x10105d6, logfont=0x1261610, font=0xeff1fc) returned 0x0 [0053.578] CoTaskMemFree (pv=0x1261610) [0053.579] CoTaskMemAlloc (cb=0x5c) returned 0x1261748 [0053.579] CoTaskMemFree (pv=0x1261748) [0053.579] CoTaskMemAlloc (cb=0x5c) returned 0x1261af0 [0053.579] CoTaskMemFree (pv=0x1261af0) [0053.580] GdipGetFontUnit (font=0x5411f08, unit=0xeff1c4) returned 0x0 [0053.580] GdipGetFontSize (font=0x5411f08, size=0xeff1c8) returned 0x0 [0053.580] GdipGetFontStyle (font=0x5411f08, style=0xeff1c0) returned 0x0 [0053.580] GdipGetFamily (font=0x5411f08, family=0xeff1bc) returned 0x0 [0053.580] GdipGetFontSize (font=0x5411f08, size=0x2dca60c) returned 0x0 [0053.580] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0053.581] GetDC (hWnd=0x0) returned 0xf0105ee [0053.581] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0xeff1d8) returned 0x0 [0053.587] GdipGetDpiY (graphics=0x65ef260, dpi=0x2dca6e8) returned 0x0 [0053.587] GdipGetFontHeight (font=0x5411f08, graphics=0x65ef260, height=0xeff1d0) returned 0x0 [0053.587] GdipGetEmHeight (family=0x54182c8, style=0, EmHeight=0xeff1d8) returned 0x0 [0053.587] GdipGetLineSpacing (family=0x54182c8, style=0, LineSpacing=0xeff1d8) returned 0x0 [0053.588] GdipDeleteGraphics (graphics=0x65ef260) returned 0x0 [0053.588] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0053.588] GdipCreateFont (fontFamily=0x54182c8, emSize=0x41040000, style=0, unit=0x3, font=0x2dca704) returned 0x0 [0053.588] GdipGetFontSize (font=0x541ef48, size=0x2dca708) returned 0x0 [0053.588] GdipDeleteFont (font=0x5411f08) returned 0x0 [0053.588] GetDC (hWnd=0x0) returned 0xf0105ee [0053.589] GdipCreateFromHDC (hdc=0xf0105ee, graphics=0xeff20c) returned 0x0 [0053.589] CoTaskMemAlloc (cb=0x5c) returned 0x1261818 [0053.590] GdipGetLogFontW (font=0x541ef48, graphics=0x65ef260, logfontW=0x1261818) returned 0x0 [0053.606] CoTaskMemFree (pv=0x1261818) [0053.606] CoTaskMemAlloc (cb=0x5c) returned 0x1261950 [0053.606] CoTaskMemFree (pv=0x1261950) [0053.606] CoTaskMemAlloc (cb=0x5c) returned 0x1261818 [0053.607] CoTaskMemFree (pv=0x1261818) [0053.607] GdipDeleteGraphics (graphics=0x65ef260) returned 0x0 [0053.607] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0053.607] CoTaskMemAlloc (cb=0x5c) returned 0x1261818 [0053.607] CreateFontIndirectW (lplf=0x1261818) returned 0x550a07c3 [0053.607] CoTaskMemFree (pv=0x1261818) [0053.607] SelectObject (hdc=0x49010536, h=0x550a07c3) returned 0x8a01c2 [0053.608] GetTextMetricsW (in: hdc=0x49010536, lptm=0xeff318 | out: lptm=0xeff318) returned 1 [0053.608] GetTextExtentPoint32W (in: hdc=0x49010536, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x2dca930 | out: psizl=0x2dca930) returned 1 [0053.610] SelectObject (hdc=0x49010536, h=0x8a01c2) returned 0x550a07c3 [0053.613] DeleteDC (hdc=0x49010536) returned 1 [0053.614] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0053.614] AdjustWindowRectEx (in: lpRect=0xeff060, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xeff060) returned 1 [0053.614] AdjustWindowRectEx (in: lpRect=0xeff2a4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff2a4) returned 1 [0053.614] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0053.614] AdjustWindowRectEx (in: lpRect=0xefefd8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xefefd8) returned 1 [0053.614] AdjustWindowRectEx (in: lpRect=0xeff0dc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0xeff0dc) returned 1 [0053.615] GetSystemMetrics (nIndex=34) returned 136 [0053.615] GetSystemMetrics (nIndex=35) returned 39 [0053.615] GetCurrentActCtx (in: lphActCtx=0xeff46c | out: lphActCtx=0xeff46c*=0x0) returned 1 [0053.615] ActivateActCtx (in: hActCtx=0x12580cc, lpCookie=0xeff47c | out: hActCtx=0x12580cc, lpCookie=0xeff47c) returned 1 [0053.616] GetCurrentActCtx (in: lphActCtx=0xeff28c | out: lphActCtx=0xeff28c*=0x12580cc) returned 1 [0053.616] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0053.616] AdjustWindowRectEx (in: lpRect=0xeff1cc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0xeff1cc) returned 1 [0053.616] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.616] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Gendarmerie V.B.3", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=132, nHeight=91, hWndParent=0x0, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x502b4 [0053.621] SetWindowLongW (hWnd=0x502b4, nIndex=-4, dwNewLong=1950089536) returned 88933822 [0053.621] GetWindowLongW (hWnd=0x502b4, nIndex=-4) returned 1950089536 [0053.621] SetWindowLongW (hWnd=0x502b4, nIndex=-4, dwNewLong=88933942) returned 1950089536 [0053.621] GetWindowLongW (hWnd=0x502b4, nIndex=-4) returned 88933942 [0053.621] GetWindowLongW (hWnd=0x502b4, nIndex=-16) returned 114229248 [0053.621] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x81, wParam=0x0, lParam=0xefecb0) returned 0x1 [0053.626] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x83, wParam=0x0, lParam=0xefec9c) returned 0x0 [0053.627] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x1, wParam=0x0, lParam=0xefecb0) returned 0x0 [0053.627] GetClientRect (in: hWnd=0x502b4, lpRect=0xefe968 | out: lpRect=0xefe968) returned 1 [0053.627] GetWindowRect (in: hWnd=0x502b4, lpRect=0xefe968 | out: lpRect=0xefe968) returned 1 [0053.627] SetWindowTextW (hWnd=0x502b4, lpString="Gendarmerie V.B.3") returned 1 [0053.627] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xc, wParam=0x0, lParam=0x2db5a78) returned 0x1 [0053.636] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x2dcaed8, nLength=0xc, lpnLengthNeeded=0xefe860 | out: pvInfo=0x2dcaed8, lpnLengthNeeded=0xefe860) returned 1 [0053.639] SetConsoleCtrlHandler (HandlerRoutine=0x54d065e, Add=1) returned 1 [0053.640] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.640] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.641] GetClassInfoW (in: hInstance=0xa80000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x2dcaf3c | out: lpWndClass=0x2dcaf3c) returned 0 [0053.643] CoTaskMemAlloc (cb=0x58) returned 0x1261108 [0053.643] RegisterClassW (lpWndClass=0xefe7b0) returned 0xc19d [0053.643] CoTaskMemFree (pv=0x1261108) [0053.644] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x70030 [0053.645] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0xefe2dc) returned 0x0 [0053.645] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0xefe2f0) returned 0x0 [0053.646] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0053.646] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0053.650] GetStartupInfoW (in: lpStartupInfo=0x2dcb394 | out: lpStartupInfo=0x2dcb394*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\xX.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0053.652] GetParent (hWnd=0x502b4) returned 0x0 [0053.652] SetWindowLongW (hWnd=0x502b4, nIndex=-8, dwNewLong=0) returned 0 [0053.653] GetSystemMetrics (nIndex=49) returned 16 [0053.653] GetSystemMetrics (nIndex=50) returned 16 [0053.653] CreateIconFromResourceEx (presbits=0x2dcb414, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xf7020d [0053.655] SendMessageW (hWnd=0x502b4, Msg=0x80, wParam=0x0, lParam=0xf7020d) returned 0x0 [0053.655] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x80, wParam=0x0, lParam=0xf7020d) returned 0x0 [0053.656] SendMessageW (hWnd=0x502b4, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0053.656] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0053.656] GetSystemMenu (hWnd=0x502b4, bRevert=0) returned 0x18012d [0053.660] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xeff29c | out: lpwndpl=0xeff29c) returned 1 [0053.660] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0053.660] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0053.660] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0053.660] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0053.660] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0053.660] GetClientRect (in: hWnd=0x502b4, lpRect=0xeff2e0 | out: lpRect=0xeff2e0) returned 1 [0053.660] GetClientRect (in: hWnd=0x502b4, lpRect=0xeff240 | out: lpRect=0xeff240) returned 1 [0053.660] GetWindowRect (in: hWnd=0x502b4, lpRect=0xeff240 | out: lpRect=0xeff240) returned 1 [0053.661] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0053.661] GetWindowLongW (hWnd=0x502b4, nIndex=-16) returned 114229248 [0053.661] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.661] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.661] GetSystemMetrics (nIndex=42) returned 0 [0053.662] GetWindowTextW (in: hWnd=0x502b4, lpString=0xeff1ac, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xeff1ac) returned 0x11 [0053.662] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.662] GetSystemMetrics (nIndex=42) returned 0 [0053.662] GetWindowTextW (in: hWnd=0x502b4, lpString=0xeff1ac, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xeff1ac) returned 0x11 [0053.662] GetWindowLongW (hWnd=0x502b4, nIndex=-16) returned 114229248 [0053.662] GetWindowLongW (hWnd=0x502b4, nIndex=-20) returned 328064 [0053.662] SetWindowLongW (hWnd=0x502b4, nIndex=-16, dwNewLong=47120384) returned 114229248 [0053.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7c, wParam=0xfffffff0, lParam=0xeff23c) returned 0x0 [0053.662] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7d, wParam=0xfffffff0, lParam=0xeff23c) returned 0x0 [0053.665] SetWindowLongW (hWnd=0x502b4, nIndex=-20, dwNewLong=327808) returned 328064 [0053.665] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7c, wParam=0xffffffec, lParam=0xeff23c) returned 0x0 [0053.665] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7d, wParam=0xffffffec, lParam=0xeff23c) returned 0x0 [0053.666] SetWindowPos (hWnd=0x502b4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0053.666] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0xeff254) returned 0x0 [0053.666] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x83, wParam=0x1, lParam=0xeff22c) returned 0x0 [0053.668] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xefef80 | out: lpwndpl=0xefef80) returned 1 [0053.668] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0xeff254) returned 0x0 [0053.668] GetClientRect (in: hWnd=0x502b4, lpRect=0xefef30 | out: lpRect=0xefef30) returned 1 [0053.668] GetWindowRect (in: hWnd=0x502b4, lpRect=0xefef30 | out: lpRect=0xefef30) returned 1 [0053.669] RedrawWindow (hWnd=0x502b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0053.669] GetSystemMenu (hWnd=0x502b4, bRevert=0) returned 0x18012d [0053.669] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xeff28c | out: lpwndpl=0xeff28c) returned 1 [0053.669] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0053.669] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0053.669] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0053.669] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0053.669] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0053.669] ShowWindow (hWnd=0x502b4, nCmdShow=5) returned 0 [0053.669] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0053.670] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.670] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.670] GetSystemMetrics (nIndex=42) returned 0 [0053.670] GetWindowTextW (in: hWnd=0x502b4, lpString=0xefee70, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.670] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xefee70) returned 0x11 [0053.679] GetStockObject (i=5) returned 0x900015 [0053.679] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.679] CoTaskMemAlloc (cb=0x5a) returned 0x12618e8 [0053.679] RegisterClassW (lpWndClass=0xefed6c) returned 0xc19e [0053.680] CoTaskMemFree (pv=0x12618e8) [0053.680] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.680] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName="TimerNativeWindow", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x6002e [0053.680] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=1950089536) returned 88934062 [0053.680] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 1950089536 [0053.681] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=88934102) returned 1950089536 [0053.681] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 88934102 [0053.681] GetWindowLongW (hWnd=0x6002e, nIndex=-16) returned 79691776 [0053.681] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x24, wParam=0x0, lParam=0xefe8e4) returned 0x0 [0053.681] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x81, wParam=0x0, lParam=0xefe8d8) returned 0x1 [0053.682] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x83, wParam=0x0, lParam=0xefe8c4) returned 0x0 [0053.682] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x6002e, Msg=0x1, wParam=0x0, lParam=0xefe8d8) returned 0x0 [0053.683] SetTimer (hWnd=0x6002e, nIDEvent=0x1, uElapse=0x1e, lpTimerFunc=0x0) returned 0x1 [0053.688] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0053.688] GetWindowLongW (hWnd=0x502b4, nIndex=-16) returned 114229248 [0053.688] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.688] GetSystemMetrics (nIndex=42) returned 0 [0053.688] GetWindowTextW (in: hWnd=0x502b4, lpString=0xefed44, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xefed44) returned 0x11 [0053.688] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.688] GetSystemMetrics (nIndex=42) returned 0 [0053.688] GetWindowTextW (in: hWnd=0x502b4, lpString=0xefed44, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.688] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xefed44) returned 0x11 [0053.688] GetWindowLongW (hWnd=0x502b4, nIndex=-16) returned 114229248 [0053.689] GetWindowLongW (hWnd=0x502b4, nIndex=-20) returned 328064 [0053.689] SetWindowLongW (hWnd=0x502b4, nIndex=-16, dwNewLong=315555840) returned 114229248 [0053.689] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7c, wParam=0xfffffff0, lParam=0xefedd4) returned 0x0 [0053.699] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7d, wParam=0xfffffff0, lParam=0xefedd4) returned 0x0 [0053.699] SetWindowLongW (hWnd=0x502b4, nIndex=-20, dwNewLong=852096) returned 328064 [0053.699] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7c, wParam=0xffffffec, lParam=0xefedd4) returned 0x0 [0053.700] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x7d, wParam=0xffffffec, lParam=0xefedd4) returned 0x0 [0053.700] SetWindowPos (hWnd=0x502b4, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0053.700] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0xefedec) returned 0x0 [0053.700] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x83, wParam=0x1, lParam=0xefedc4) returned 0x0 [0053.701] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x85, wParam=0x270407d6, lParam=0x0) returned 0x0 [0053.703] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xefeb34 | out: lpwndpl=0xefeb34) returned 1 [0053.703] GetClientRect (in: hWnd=0x502b4, lpRect=0xefeae0 | out: lpRect=0xefeae0) returned 1 [0053.703] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.703] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.703] GetSystemMetrics (nIndex=42) returned 0 [0053.703] GetWindowTextW (in: hWnd=0x502b4, lpString=0xefe994, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.703] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xefe994) returned 0x11 [0053.703] GetClientRect (in: hWnd=0x502b4, lpRect=0xefe9e8 | out: lpRect=0xefe9e8) returned 1 [0053.704] GetSysColor (nIndex=10) returned 0xb4b4b4 [0053.704] GetSysColor (nIndex=2) returned 0xd1b499 [0053.704] GetSysColor (nIndex=9) returned 0x0 [0053.704] GetSysColor (nIndex=12) returned 0xababab [0053.704] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.704] GetSysColor (nIndex=20) returned 0xffffff [0053.704] GetSysColor (nIndex=16) returned 0xa0a0a0 [0053.704] GetSysColor (nIndex=15) returned 0xf0f0f0 [0053.704] GetSysColor (nIndex=16) returned 0xa0a0a0 [0053.704] GetSysColor (nIndex=21) returned 0x696969 [0053.704] GetSysColor (nIndex=22) returned 0xe3e3e3 [0053.705] GetSysColor (nIndex=20) returned 0xffffff [0053.705] GetSysColor (nIndex=18) returned 0x0 [0053.705] GetSysColor (nIndex=1) returned 0x0 [0053.705] GetSysColor (nIndex=27) returned 0xead1b9 [0053.705] GetSysColor (nIndex=28) returned 0xf2e4d7 [0053.705] GetSysColor (nIndex=17) returned 0x6d6d6d [0053.705] GetSysColor (nIndex=13) returned 0xd77800 [0053.705] GetSysColor (nIndex=14) returned 0xffffff [0053.705] GetSysColor (nIndex=26) returned 0xcc6600 [0053.705] GetSysColor (nIndex=11) returned 0xfcf7f4 [0053.705] GetSysColor (nIndex=3) returned 0xdbcdbf [0053.705] GetSysColor (nIndex=19) returned 0x0 [0053.705] GetSysColor (nIndex=24) returned 0xe1ffff [0053.705] GetSysColor (nIndex=23) returned 0x0 [0053.705] GetSysColor (nIndex=4) returned 0xf0f0f0 [0053.705] GetSysColor (nIndex=30) returned 0xf0f0f0 [0053.705] GetSysColor (nIndex=29) returned 0xd77800 [0053.705] GetSysColor (nIndex=7) returned 0x0 [0053.705] GetSysColor (nIndex=0) returned 0xc8c8c8 [0053.705] GetSysColor (nIndex=5) returned 0xffffff [0053.705] GetSysColor (nIndex=6) returned 0x646464 [0053.705] GetSysColor (nIndex=8) returned 0x0 [0053.706] GetSystemMetrics (nIndex=80) returned 1 [0053.725] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x54d06fe, dwData=0x0) returned 1 [0053.731] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0xefe648 | out: lpmi=0xefe648) returned 1 [0053.732] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x640107a3 [0053.732] GetDeviceCaps (hdc=0x640107a3, index=12) returned 32 [0053.732] GetDeviceCaps (hdc=0x640107a3, index=14) returned 1 [0053.732] DeleteDC (hdc=0x640107a3) returned 1 [0053.732] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0053.732] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0053.733] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x74050671 [0053.733] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0053.733] SaveDC (hdc=0xf0105ee) returned 1 [0053.733] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0053.734] CreateSolidBrush (color=0xf0f0f0) returned 0x1a1007bb [0053.735] FillRect (hDC=0xf0105ee, lprc=0xefe888, hbr=0x1a1007bb) returned 1 [0053.735] DeleteObject (ho=0x1a1007bb) returned 1 [0053.735] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0053.736] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xefeb18 | out: lpwndpl=0xefeb18) returned 1 [0053.736] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0xefedec) returned 0x0 [0053.736] GetClientRect (in: hWnd=0x502b4, lpRect=0xefeac8 | out: lpRect=0xefeac8) returned 1 [0053.736] GetWindowRect (in: hWnd=0x502b4, lpRect=0xefeac8 | out: lpRect=0xefeac8) returned 1 [0053.737] RedrawWindow (hWnd=0x502b4, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0053.737] GetSystemMenu (hWnd=0x502b4, bRevert=0) returned 0x18012d [0053.737] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xefee24 | out: lpwndpl=0xefee24) returned 1 [0053.737] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0053.737] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0053.737] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0053.737] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0053.737] EnableMenuItem (hMenu=0x18012d, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0053.782] SetLayeredWindowAttributes (hwnd=0x502b4, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0053.785] GetCurrentThreadId () returned 0x13d4 [0053.791] EnumThreadWindows (dwThreadId=0x13d4, lpfn=0x54d0726, lParam=0x502b4) returned 1 [0053.818] GetWindowLongW (hWnd=0x70030, nIndex=-8) returned 0 [0053.819] GetWindowLongW (hWnd=0x502b4, nIndex=-8) returned 0 [0053.819] GetWindowLongW (hWnd=0x40068, nIndex=-8) returned 328372 [0053.872] SetWindowLongW (hWnd=0x40068, nIndex=-8, dwNewLong=0) returned 328372 [0053.877] GetParent (hWnd=0x502b4) returned 0x0 [0053.877] GetWindowLongW (hWnd=0x502b4, nIndex=-20) returned 852352 [0053.877] DestroyWindow (hWnd=0x502b4) returned 1 [0053.877] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0053.877] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x46, wParam=0x0, lParam=0xefed24) returned 0x0 [0053.880] GetWindowPlacement (in: hWnd=0x502b4, lpwndpl=0xefea50 | out: lpwndpl=0xefea50) returned 1 [0053.880] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x47, wParam=0x0, lParam=0xefed24) returned 0x0 [0053.880] GetClientRect (in: hWnd=0x502b4, lpRect=0xefea00 | out: lpRect=0xefea00) returned 1 [0053.880] GetWindowRect (in: hWnd=0x502b4, lpRect=0xefea00 | out: lpRect=0xefea00) returned 1 [0053.881] GetWindowTextLengthW (hWnd=0x502b4) returned 17 [0053.881] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.881] GetSystemMetrics (nIndex=42) returned 0 [0053.881] GetWindowTextW (in: hWnd=0x502b4, lpString=0xefe918, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.881] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0xd, wParam=0x12, lParam=0xefe918) returned 0x11 [0053.882] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0053.882] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x502b4, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0053.887] GetCurrentActCtx (in: lphActCtx=0xefed84 | out: lphActCtx=0xefed84*=0x12580cc) returned 1 [0053.887] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0053.887] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.887] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="Gendarmerie V.B.3", dwStyle=0x2cf0000, X=104, Y=104, nWidth=132, nHeight=91, hWndParent=0x0, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x7005c [0053.888] SetWindowLongW (hWnd=0x7005c, nIndex=-4, dwNewLong=1950089536) returned 88933822 [0053.888] GetWindowLongW (hWnd=0x7005c, nIndex=-4) returned 1950089536 [0053.888] SetWindowLongW (hWnd=0x7005c, nIndex=-4, dwNewLong=88934222) returned 1950089536 [0053.888] GetWindowLongW (hWnd=0x7005c, nIndex=-4) returned 88934222 [0053.888] GetWindowLongW (hWnd=0x7005c, nIndex=-16) returned 114229248 [0053.889] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x81, wParam=0x0, lParam=0xefe7a8) returned 0x1 [0053.889] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x0, lParam=0xefe794) returned 0x0 [0053.890] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x1, wParam=0x0, lParam=0xefe7a8) returned 0x0 [0053.890] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe460 | out: lpRect=0xefe460) returned 1 [0053.890] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefe460 | out: lpRect=0xefe460) returned 1 [0053.890] SetWindowTextW (hWnd=0x7005c, lpString="Gendarmerie V.B.3") returned 1 [0053.890] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xc, wParam=0x0, lParam=0x2dccd20) returned 0x1 [0053.891] SetLayeredWindowAttributes (hwnd=0x7005c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0053.892] GetStartupInfoW (in: lpStartupInfo=0x2dcd008 | out: lpStartupInfo=0x2dcd008*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\xX.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0053.893] GetParent (hWnd=0x7005c) returned 0x0 [0053.893] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0053.893] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xa80000, lpParam=0x0) returned 0x70036 [0053.894] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=1950089536) returned 88934062 [0053.894] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 1950089536 [0053.894] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=88934262) returned 1950089536 [0053.908] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 88934262 [0053.908] GetWindowLongW (hWnd=0x70036, nIndex=-16) returned 79691776 [0053.910] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x24, wParam=0x0, lParam=0xefe7dc) returned 0x0 [0053.910] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x81, wParam=0x0, lParam=0xefe7d0) returned 0x1 [0053.910] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x83, wParam=0x0, lParam=0xefe7bc) returned 0x0 [0053.911] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x1, wParam=0x0, lParam=0xefe7d0) returned 0x0 [0053.912] SetWindowLongW (hWnd=0x7005c, nIndex=-8, dwNewLong=458806) returned 0 [0053.914] SendMessageW (hWnd=0x7005c, Msg=0x80, wParam=0x0, lParam=0xf7020d) returned 0x0 [0053.914] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x80, wParam=0x0, lParam=0xf7020d) returned 0x0 [0053.914] SendMessageW (hWnd=0x7005c, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0053.914] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0053.983] GetSystemMenu (hWnd=0x7005c, bRevert=0) returned 0x19012d [0053.983] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefed94 | out: lpwndpl=0xefed94) returned 1 [0053.984] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0053.984] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0053.984] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0053.984] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0053.984] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0053.984] GetClientRect (in: hWnd=0x7005c, lpRect=0xefedd8 | out: lpRect=0xefedd8) returned 1 [0053.984] GetClientRect (in: hWnd=0x7005c, lpRect=0xefed38 | out: lpRect=0xefed38) returned 1 [0053.984] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefed38 | out: lpRect=0xefed38) returned 1 [0053.984] SetWindowPos (hWnd=0x7005c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0053.984] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x46, wParam=0x0, lParam=0xefeca4) returned 0x0 [0053.988] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0053.990] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefe9ec | out: lpwndpl=0xefe9ec) returned 1 [0053.990] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe998 | out: lpRect=0xefe998) returned 1 [0053.990] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0053.990] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.990] GetSystemMetrics (nIndex=42) returned 0 [0053.990] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefe84c, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.990] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefe84c) returned 0x11 [0053.990] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe8a0 | out: lpRect=0xefe8a0) returned 1 [0053.990] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0053.990] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0053.990] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x120507d0 [0053.990] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0053.990] SaveDC (hdc=0xf0105ee) returned 1 [0053.990] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0053.990] CreateSolidBrush (color=0xf0f0f0) returned 0x1b1007bb [0053.990] FillRect (hDC=0xf0105ee, lprc=0xefe740, hbr=0x1b1007bb) returned 1 [0053.990] DeleteObject (ho=0x1b1007bb) returned 1 [0053.991] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0053.991] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefe9d0 | out: lpwndpl=0xefe9d0) returned 1 [0053.991] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x47, wParam=0x0, lParam=0xefeca4) returned 0x0 [0053.991] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe980 | out: lpRect=0xefe980) returned 1 [0053.991] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefe980 | out: lpRect=0xefe980) returned 1 [0053.994] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x1, lParam=0xefe7bc) returned 0x0 [0053.996] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0053.997] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefe52c | out: lpwndpl=0xefe52c) returned 1 [0053.997] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe4d8 | out: lpRect=0xefe4d8) returned 1 [0053.997] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0053.997] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0053.997] GetSystemMetrics (nIndex=42) returned 0 [0053.997] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefe38c, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0053.997] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefe38c) returned 0x11 [0053.997] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe3e0 | out: lpRect=0xefe3e0) returned 1 [0053.998] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0053.998] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0053.998] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x120507d0 [0053.998] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0053.998] SaveDC (hdc=0x10105d6) returned 1 [0053.998] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0053.998] CreateSolidBrush (color=0xf0f0f0) returned 0x1c1007bb [0053.998] FillRect (hDC=0x10105d6, lprc=0xefe280, hbr=0x1c1007bb) returned 1 [0053.998] DeleteObject (ho=0x1c1007bb) returned 1 [0053.998] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0053.998] SetWindowLongW (hWnd=0x7005c, nIndex=-8, dwNewLong=458806) returned 458806 [0054.000] SendMessageW (hWnd=0x70036, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0054.000] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x80, wParam=0x1, lParam=0x402ab) returned 0x0 [0054.001] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0054.001] GetWindowLongW (hWnd=0x7005c, nIndex=-16) returned 382664704 [0054.001] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0054.001] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0054.001] GetSystemMetrics (nIndex=42) returned 0 [0054.001] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefeca4, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0054.002] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefeca4) returned 0x11 [0054.002] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0054.002] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0054.002] GetSystemMetrics (nIndex=42) returned 0 [0054.002] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefeca4, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0054.002] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefeca4) returned 0x11 [0054.002] GetWindowLongW (hWnd=0x7005c, nIndex=-16) returned 382664704 [0054.002] GetWindowLongW (hWnd=0x7005c, nIndex=-20) returned 590208 [0054.002] SetWindowLongW (hWnd=0x7005c, nIndex=-16, dwNewLong=315555840) returned 382664704 [0054.002] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x7c, wParam=0xfffffff0, lParam=0xefed34) returned 0x0 [0054.002] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x7d, wParam=0xfffffff0, lParam=0xefed34) returned 0x0 [0054.003] SetWindowLongW (hWnd=0x7005c, nIndex=-20, dwNewLong=589952) returned 590208 [0054.003] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x7c, wParam=0xffffffec, lParam=0xefed34) returned 0x0 [0054.003] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x7d, wParam=0xffffffec, lParam=0xefed34) returned 0x0 [0054.004] SetWindowPos (hWnd=0x7005c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0054.004] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x46, wParam=0x0, lParam=0xefed4c) returned 0x0 [0054.004] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x1, lParam=0xefed24) returned 0x0 [0054.005] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0054.006] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefea94 | out: lpwndpl=0xefea94) returned 1 [0054.006] GetClientRect (in: hWnd=0x7005c, lpRect=0xefea40 | out: lpRect=0xefea40) returned 1 [0054.006] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0054.007] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0054.007] GetSystemMetrics (nIndex=42) returned 0 [0054.007] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefe8f4, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0054.007] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefe8f4) returned 0x11 [0054.007] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe948 | out: lpRect=0xefe948) returned 1 [0054.007] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0054.007] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0054.007] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x120507d0 [0054.007] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0054.007] SaveDC (hdc=0xf0105ee) returned 1 [0054.007] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0054.007] CreateSolidBrush (color=0xf0f0f0) returned 0x1d1007bb [0054.007] FillRect (hDC=0xf0105ee, lprc=0xefe7e8, hbr=0x1d1007bb) returned 1 [0054.007] DeleteObject (ho=0x1d1007bb) returned 1 [0054.007] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0054.007] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefea78 | out: lpwndpl=0xefea78) returned 1 [0054.008] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x47, wParam=0x0, lParam=0xefed4c) returned 0x0 [0054.008] GetClientRect (in: hWnd=0x7005c, lpRect=0xefea28 | out: lpRect=0xefea28) returned 1 [0054.008] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefea28 | out: lpRect=0xefea28) returned 1 [0054.008] RedrawWindow (hWnd=0x7005c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0054.008] GetSystemMenu (hWnd=0x7005c, bRevert=0) returned 0x19012d [0054.008] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefed84 | out: lpwndpl=0xefed84) returned 1 [0054.008] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0054.008] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0054.008] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0054.008] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0054.008] EnableMenuItem (hMenu=0x19012d, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0054.008] SetWindowLongW (hWnd=0x40068, nIndex=-8, dwNewLong=458844) returned 458800 [0054.133] GetCurrentProcess () returned 0xffffffff [0054.133] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9d0 | out: TokenHandle=0xefe9d0*=0x354) returned 1 [0054.145] GetCurrentProcess () returned 0xffffffff [0054.146] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9e0 | out: TokenHandle=0xefe9e0*=0x358) returned 1 [0054.244] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x35c [0054.244] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x360 [0054.257] GetCurrentProcess () returned 0xffffffff [0054.258] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9c8 | out: TokenHandle=0xefe9c8*=0x364) returned 1 [0054.276] GetCurrentProcess () returned 0xffffffff [0054.276] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9d8 | out: TokenHandle=0xefe9d8*=0x368) returned 1 [0054.288] QueryPerformanceFrequency (in: lpFrequency=0xfe5ac8 | out: lpFrequency=0xfe5ac8*=100000000) returned 1 [0054.289] QueryPerformanceCounter (in: lpPerformanceCount=0xefed4c | out: lpPerformanceCount=0xefed4c*=14993076011) returned 1 [0054.292] GetCurrentProcess () returned 0xffffffff [0054.292] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe994 | out: TokenHandle=0xefe994*=0x36c) returned 1 [0054.295] GetCurrentProcess () returned 0xffffffff [0054.295] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9a4 | out: TokenHandle=0xefe9a4*=0x370) returned 1 [0054.310] GetCurrentProcess () returned 0xffffffff [0054.310] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9a8 | out: TokenHandle=0xefe9a8*=0x374) returned 1 [0054.312] GetCurrentProcess () returned 0xffffffff [0054.312] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe9b8 | out: TokenHandle=0xefe9b8*=0x378) returned 1 [0054.316] GetCurrentProcess () returned 0xffffffff [0054.316] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefec30 | out: TokenHandle=0xefec30*=0x37c) returned 1 [0054.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0xefdd6c | out: phkResult=0xefdd6c*=0x380) returned 0x0 [0054.321] RegQueryValueExW (in: hKey=0x380, lpValueName="InstallationType", lpReserved=0x0, lpType=0xefdd8c, lpData=0x0, lpcbData=0xefdd88*=0x0 | out: lpType=0xefdd8c*=0x1, lpData=0x0, lpcbData=0xefdd88*=0xe) returned 0x0 [0054.321] RegQueryValueExW (in: hKey=0x380, lpValueName="InstallationType", lpReserved=0x0, lpType=0xefdd8c, lpData=0x2dd9a24, lpcbData=0xefdd88*=0xe | out: lpType=0xefdd8c*=0x1, lpData="Client", lpcbData=0xefdd88*=0xe) returned 0x0 [0054.328] RegCloseKey (hKey=0x380) returned 0x0 [0054.830] CoTaskMemAlloc (cb=0xcc0) returned 0x128af78 [0054.831] RasEnumConnectionsW (in: param_1=0x128af78, param_2=0xefec40, param_3=0xefec44 | out: param_1=0x128af78, param_2=0xefec40, param_3=0xefec44) returned 0x0 [0054.981] CoTaskMemFree (pv=0x128af78) [0055.426] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xefea2c | out: lpWSAData=0xefea2c) returned 0 [0055.430] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e4 [0055.702] setsockopt (s=0x3e4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0055.702] closesocket (s=0x3e4) returned 0 [0055.703] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e4 [0055.704] setsockopt (s=0x3e4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0055.704] closesocket (s=0x3e4) returned 0 [0055.704] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3e4 [0055.705] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e8 [0055.706] ioctlsocket (in: s=0x3e4, cmd=-2147195266, argp=0xefec48 | out: argp=0xefec48) returned 0 [0055.706] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3ec [0055.706] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0 [0055.706] ioctlsocket (in: s=0x3ec, cmd=-2147195266, argp=0xefec48 | out: argp=0xefec48) returned 0 [0055.707] WSAIoctl (in: s=0x3e4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefec30, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefec30, lpOverlapped=0x0) returned -1 [0055.710] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe960, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.714] WSAEventSelect (s=0x3e4, hEventObject=0x3e8, lNetworkEvents=512) returned 0 [0055.715] WSAIoctl (in: s=0x3ec, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefec30, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefec30, lpOverlapped=0x0) returned -1 [0055.715] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe960, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.715] WSAEventSelect (s=0x3ec, hEventObject=0x3f0, lNetworkEvents=512) returned 0 [0055.716] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3f8 [0055.716] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3f8, param_3=0x3) returned 0x0 [0055.725] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0xefec5c | out: phkResult=0xefec5c*=0x414) returned 0x0 [0055.726] RegOpenKeyExW (in: hKey=0x414, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0xefec10 | out: phkResult=0xefec10*=0x418) returned 0x0 [0055.726] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x41c [0055.726] RegNotifyChangeKeyValue (hKey=0x418, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x41c, fAsynchronous=1) returned 0x0 [0055.726] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0xefec14 | out: phkResult=0xefec14*=0x420) returned 0x0 [0055.728] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x424 [0055.728] RegNotifyChangeKeyValue (hKey=0x420, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x424, fAsynchronous=1) returned 0x0 [0055.728] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0xefec14 | out: phkResult=0xefec14*=0x428) returned 0x0 [0055.728] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0055.728] RegNotifyChangeKeyValue (hKey=0x428, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x42c, fAsynchronous=1) returned 0x0 [0055.729] GetCurrentProcess () returned 0xffffffff [0055.729] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefec00 | out: TokenHandle=0xefec00*=0x430) returned 1 [0055.732] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe508 | out: phkResult=0xefe508*=0x434) returned 0x0 [0055.733] RegQueryValueExW (in: hKey=0x434, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0xefe524, lpData=0x0, lpcbData=0xefe520*=0x0 | out: lpType=0xefe524*=0x0, lpData=0x0, lpcbData=0xefe520*=0x0) returned 0x2 [0055.733] RegCloseKey (hKey=0x434) returned 0x0 [0056.255] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x128ad30 [0056.629] WinHttpSetTimeouts (hInternet=0x128ad30, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0056.629] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0xefec10 | out: pProxyConfig=0xefec10) returned 1 [0057.092] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0xefe480, nSize=0x80 | out: lpBuffer="ﾉ琉￿￿ïဢ玳㦀牴皴犭佚玼橱⪠Ĥ皴犭㦀牴胰犘㦀牴胰犘ï啾玼￿￿ï꛰琉￿￿佚玼刐玼䪌犷") returned 0x0 [0057.093] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0xefe480, nSize=0x80 | out: lpBuffer="ﾉ琉￿￿ïဢ玳㦀牴皴犭佚玼橱⪠Ĥ皴犭㦀牴胰犘㦀牴胰犘ï啾玼￿￿ï꛰琉￿￿佚玼刐玼䪌犷") returned 0x0 [0057.096] EtwEventRegister (in: ProviderId=0x2ddc6cc, EnableCallback=0x54d079e, CallbackContext=0x0, RegHandle=0x2ddc6a8 | out: RegHandle=0x2ddc6a8) returned 0x0 [0057.096] EtwEventSetInformation (RegHandle=0x1285e80, InformationClass=0x45, EventInformation=0x2, InformationLength=0x2ddc668) returned 0x0 [0057.099] GetCurrentProcess () returned 0xffffffff [0057.099] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe970 | out: TokenHandle=0xefe970*=0x47c) returned 1 [0057.101] GetCurrentProcess () returned 0xffffffff [0057.101] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe980 | out: TokenHandle=0xefe980*=0x488) returned 1 [0057.183] SetEvent (hEvent=0x35c) returned 1 [0057.244] GetCurrentProcess () returned 0xffffffff [0057.244] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8c4 | out: TokenHandle=0xefe8c4*=0x4a0) returned 1 [0057.245] GetCurrentProcess () returned 0xffffffff [0057.245] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe8d4 | out: TokenHandle=0xefe8d4*=0x4a4) returned 1 [0057.246] GetTimeZoneInformation (in: lpTimeZoneInformation=0xefea44 | out: lpTimeZoneInformation=0xefea44) returned 0x2 [0057.250] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0xefe8a0 | out: pTimeZoneInformation=0xefe8a0) returned 0x2 [0057.252] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe984 | out: phkResult=0xefe984*=0x4a8) returned 0x0 [0057.252] RegQueryValueExW (in: hKey=0x4a8, lpValueName="TZI", lpReserved=0x0, lpType=0xefe9a0, lpData=0x0, lpcbData=0xefe99c*=0x0 | out: lpType=0xefe9a0*=0x3, lpData=0x0, lpcbData=0xefe99c*=0x2c) returned 0x0 [0057.252] RegQueryValueExW (in: hKey=0x4a8, lpValueName="TZI", lpReserved=0x0, lpType=0xefe9a0, lpData=0x2ddf660, lpcbData=0xefe99c*=0x2c | out: lpType=0xefe9a0*=0x3, lpData=0x2ddf660*, lpcbData=0xefe99c*=0x2c) returned 0x0 [0057.252] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe7d8 | out: phkResult=0xefe7d8*=0x0) returned 0x2 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0xefe978, lpData=0x0, lpcbData=0xefe974*=0x0 | out: lpType=0xefe978*=0x1, lpData=0x0, lpcbData=0xefe974*=0x20) returned 0x0 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Display", lpReserved=0x0, lpType=0xefe978, lpData=0x2ddfa84, lpcbData=0xefe974*=0x20 | out: lpType=0xefe978*=0x1, lpData="@tzres.dll,-320", lpcbData=0xefe974*=0x20) returned 0x0 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0xefe978, lpData=0x0, lpcbData=0xefe974*=0x0 | out: lpType=0xefe978*=0x1, lpData=0x0, lpcbData=0xefe974*=0x20) returned 0x0 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Std", lpReserved=0x0, lpType=0xefe978, lpData=0x2ddfadc, lpcbData=0xefe974*=0x20 | out: lpType=0xefe978*=0x1, lpData="@tzres.dll,-322", lpcbData=0xefe974*=0x20) returned 0x0 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0xefe978, lpData=0x0, lpcbData=0xefe974*=0x0 | out: lpType=0xefe978*=0x1, lpData=0x0, lpcbData=0xefe974*=0x20) returned 0x0 [0057.253] RegQueryValueExW (in: hKey=0x4a8, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0xefe978, lpData=0x2ddfb34, lpcbData=0xefe974*=0x20 | out: lpType=0xefe978*=0x1, lpData="@tzres.dll,-321", lpcbData=0xefe974*=0x20) returned 0x0 [0061.388] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.388] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x12aaab8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0061.393] CoTaskMemFree (pv=0x12aaab8) [0061.393] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.393] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath=0x12aaab8, pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c | out: pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c) returned 1 [0061.398] CoTaskMemFree (pv=0x0) [0061.399] CoTaskMemFree (pv=0x12aaab8) [0061.399] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x54a0001 [0061.403] CoTaskMemAlloc (cb=0x3ec) returned 0x12ab4d8 [0061.403] LoadStringW (in: hInstance=0x54a0001, uID=0x140, lpBuffer=0x12ab4d8, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0061.403] CoTaskMemFree (pv=0x12ab4d8) [0061.403] FreeLibrary (hLibModule=0x54a0001) returned 1 [0061.404] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.404] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x12aaab8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0061.404] CoTaskMemFree (pv=0x12aaab8) [0061.404] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.404] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath=0x12aaab8, pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c | out: pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c) returned 1 [0061.404] CoTaskMemFree (pv=0x0) [0061.404] CoTaskMemFree (pv=0x12aaab8) [0061.404] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x54a0001 [0061.405] CoTaskMemAlloc (cb=0x3ec) returned 0x12ab4d8 [0061.405] LoadStringW (in: hInstance=0x54a0001, uID=0x142, lpBuffer=0x12ab4d8, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0061.405] CoTaskMemFree (pv=0x12ab4d8) [0061.405] FreeLibrary (hLibModule=0x54a0001) returned 1 [0061.411] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.411] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x12aaab8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0061.411] CoTaskMemFree (pv=0x12aaab8) [0061.411] CoTaskMemAlloc (cb=0x20c) returned 0x12aaab8 [0061.411] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath=0x12aaab8, pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c | out: pwszLanguage=0x0, pcchLanguage=0xefe994, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0xefe998, pululEnumerator=0xefe98c) returned 1 [0061.411] CoTaskMemFree (pv=0x0) [0061.411] CoTaskMemFree (pv=0x12aaab8) [0061.412] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x54a0001 [0061.412] CoTaskMemAlloc (cb=0x3ec) returned 0x12ab4d8 [0061.412] LoadStringW (in: hInstance=0x54a0001, uID=0x141, lpBuffer=0x12ab4d8, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0061.412] CoTaskMemFree (pv=0x12ab4d8) [0061.412] FreeLibrary (hLibModule=0x54a0001) returned 1 [0061.413] RegCloseKey (hKey=0x4a8) returned 0x0 [0061.413] SetEvent (hEvent=0x35c) returned 1 [0061.486] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4a8 [0061.487] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x52c [0061.487] ioctlsocket (in: s=0x4a8, cmd=-2147195266, argp=0xefebe8 | out: argp=0xefebe8) returned 0 [0061.487] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x524 [0061.487] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x530 [0061.487] ioctlsocket (in: s=0x524, cmd=-2147195266, argp=0xefebe8 | out: argp=0xefebe8) returned 0 [0061.487] WSAIoctl (in: s=0x4a8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefebd0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefebd0, lpOverlapped=0x0) returned -1 [0061.487] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe900, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0061.487] WSAEventSelect (s=0x4a8, hEventObject=0x52c, lNetworkEvents=512) returned 0 [0061.487] WSAIoctl (in: s=0x524, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0xefebd0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0xefebd0, lpOverlapped=0x0) returned -1 [0061.488] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0xefe900, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0061.488] WSAEventSelect (s=0x524, hEventObject=0x530, lNetworkEvents=512) returned 0 [0061.493] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0xefebcc*=0x0 | out: AdapterAddresses=0x0, SizePointer=0xefebcc*=0x818) returned 0x6f [0061.501] LocalAlloc (uFlags=0x0, uBytes=0x818) returned 0x12ab818 [0061.501] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x12ab818, SizePointer=0xefebcc*=0x818 | out: AdapterAddresses=0x12ab818*(Alignment=0x300000178, Length=0x178, IfIndex=0x3, Next=0x12abac8, AdapterName="{9E48833B-70C6-43EE-85DC-893C1782D802}", FirstUnicastAddress=0x12aba3c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xf8, [1]=0x2e, [2]=0xdb, [3]=0x2, [4]=0x75, [5]=0x58, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x3, ZoneIndices=([0]=0x3, [1]=0x3, [2]=0x3, [3]=0x3, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x12ab990*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0xefebcc*=0x818) returned 0x0 [0061.597] LocalFree (hMem=0x12ab818) returned 0x0 [0061.601] CoTaskMemAlloc (cb=0x20c) returned 0x129b488 [0061.601] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x129b488, nSize=0x104 | out: lpBuffer="렘ĪꯐĪណ潑᝾潑\x03") returned 0x0 [0061.601] CoTaskMemFree (pv=0x129b488) [0061.601] CoTaskMemAlloc (cb=0x20c) returned 0x129b488 [0061.601] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x129b488, nSize=0x104 | out: lpBuffer="렘ĪꯐĪណ潑᝾潑\x03") returned 0x0 [0061.601] CoTaskMemFree (pv=0x129b488) [0061.604] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x534 [0061.605] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x538 [0061.610] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe9cc*=0x52c, lpdwindex=0xefe7ec | out: lpdwindex=0xefe7ec) returned 0x80010115 [0061.956] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe9cc*=0x530, lpdwindex=0xefe7ec | out: lpdwindex=0xefe7ec) returned 0x80010115 [0061.961] WSAConnect (in: s=0x534, name=0x2deafd4*(sa_family=2, sin_port=0x50, sin_addr="127.0.0.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0063.088] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274d, dwLanguageId=0x0, lpBuffer=0xefe864, nSize=0x101, Arguments=0x0 | out: lpBuffer="No connection could be made because the target machine actively refused it.\r\n") returned 0x4d [0063.132] setsockopt (s=0x534, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0063.132] closesocket (s=0x534) returned 0 [0063.133] setsockopt (s=0x538, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0063.133] closesocket (s=0x538) returned 0 [0063.143] GetLogicalDrives () returned 0x4 [0063.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0063.205] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0063.205] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2ddc2fa1, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x2ddc2fa1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x125f7e8 [0063.206] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2ddc2fa1, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x2ddc2fa1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0dea20, ftCreationTime.dwHighDateTime=0x1d5eabb, ftLastAccessTime.dwLowDateTime=0xe4aa04c0, ftLastAccessTime.dwHighDateTime=0x1d5e5d5, ftLastWriteTime.dwLowDateTime=0xe4aa04c0, ftLastWriteTime.dwHighDateTime=0x1d5e5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0V5ASM9JptEW4M8.png", cAlternateFileName="0V5ASM~1.PNG")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df4b9d0, ftCreationTime.dwHighDateTime=0x1d5e70c, ftLastAccessTime.dwLowDateTime=0xdfc48300, ftLastAccessTime.dwHighDateTime=0x1d5f0f1, ftLastWriteTime.dwLowDateTime=0xdfc48300, ftLastWriteTime.dwHighDateTime=0x1d5f0f1, nFileSizeHigh=0x0, nFileSizeLow=0x1673d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C9KWd2EC.jpg", cAlternateFileName="2C9KWD~1.JPG")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886d94b0, ftCreationTime.dwHighDateTime=0x1d5e986, ftLastAccessTime.dwLowDateTime=0x3f120260, ftLastAccessTime.dwHighDateTime=0x1d5e1b6, ftLastWriteTime.dwLowDateTime=0x3f120260, ftLastWriteTime.dwHighDateTime=0x1d5e1b6, nFileSizeHigh=0x0, nFileSizeLow=0x117cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GJxgoamnWHGbtl-7q.doc", cAlternateFileName="6GJXGO~1.DOC")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6680aab0, ftCreationTime.dwHighDateTime=0x1d5e678, ftLastAccessTime.dwLowDateTime=0xb60f5bd0, ftLastAccessTime.dwHighDateTime=0x1d5ebdc, ftLastWriteTime.dwLowDateTime=0xb60f5bd0, ftLastWriteTime.dwHighDateTime=0x1d5ebdc, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bai6sTP0gHGTAw4Szx.gif", cAlternateFileName="BAI6ST~1.GIF")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475c7620, ftCreationTime.dwHighDateTime=0x1d5e284, ftLastAccessTime.dwLowDateTime=0x86f2be30, ftLastAccessTime.dwHighDateTime=0x1d5e0b7, ftLastWriteTime.dwLowDateTime=0x86f2be30, ftLastWriteTime.dwHighDateTime=0x1d5e0b7, nFileSizeHigh=0x0, nFileSizeLow=0xfeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMeIHrHrTt.swf", cAlternateFileName="CMEIHR~1.SWF")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.207] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af86550, ftCreationTime.dwHighDateTime=0x1d5e31e, ftLastAccessTime.dwLowDateTime=0x5e88e730, ftLastAccessTime.dwHighDateTime=0x1d5efe4, ftLastWriteTime.dwLowDateTime=0x5e88e730, ftLastWriteTime.dwHighDateTime=0x1d5efe4, nFileSizeHigh=0x0, nFileSizeLow=0x171a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dutcK49w7 8.wav", cAlternateFileName="DUTCK4~1.WAV")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7214e750, ftCreationTime.dwHighDateTime=0x1d5e96c, ftLastAccessTime.dwLowDateTime=0xf3f19230, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xf3f19230, ftLastWriteTime.dwHighDateTime=0x1d5e815, nFileSizeHigh=0x0, nFileSizeLow=0xfd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EV5Wd a.jpg", cAlternateFileName="EV5WDA~1.JPG")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28cbda0, ftCreationTime.dwHighDateTime=0x1d5eb40, ftLastAccessTime.dwLowDateTime=0x6b7b4270, ftLastAccessTime.dwHighDateTime=0x1d5e78e, ftLastWriteTime.dwLowDateTime=0x6b7b4270, ftLastWriteTime.dwHighDateTime=0x1d5e78e, nFileSizeHigh=0x0, nFileSizeLow=0xb292, dwReserved0=0x0, dwReserved1=0x0, cFileName="GkuS.docx", cAlternateFileName="GKUS~1.DOC")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70efd040, ftCreationTime.dwHighDateTime=0x1d5e432, ftLastAccessTime.dwLowDateTime=0xd2298670, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0xd2298670, ftLastWriteTime.dwHighDateTime=0x1d5e695, nFileSizeHigh=0x0, nFileSizeLow=0xfaa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKSiSRxDBr2gdWg8.gif", cAlternateFileName="IKSISR~1.GIF")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5758880, ftCreationTime.dwHighDateTime=0x1d5e1fa, ftLastAccessTime.dwLowDateTime=0x4327a300, ftLastAccessTime.dwHighDateTime=0x1d5e5da, ftLastWriteTime.dwLowDateTime=0x4327a300, ftLastWriteTime.dwHighDateTime=0x1d5e5da, nFileSizeHigh=0x0, nFileSizeLow=0xc910, dwReserved0=0x0, dwReserved1=0x0, cFileName="iR1vMzL3ZLw0J V2.jpg", cAlternateFileName="IR1VMZ~1.JPG")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57db0a0, ftCreationTime.dwHighDateTime=0x1d5e862, ftLastAccessTime.dwLowDateTime=0x59926ab0, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0x59926ab0, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0x8ccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjpZ4inX8eFdXTD.ots", cAlternateFileName="JJPZ4I~1.OTS")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b38c0, ftCreationTime.dwHighDateTime=0x1d5e7cd, ftLastAccessTime.dwLowDateTime=0x412121b0, ftLastAccessTime.dwHighDateTime=0x1d5eefb, ftLastWriteTime.dwLowDateTime=0x412121b0, ftLastWriteTime.dwHighDateTime=0x1d5eefb, nFileSizeHigh=0x0, nFileSizeLow=0x650f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jOPLa0 DCGPa4J.swf", cAlternateFileName="JOPLA0~1.SWF")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb03d230, ftCreationTime.dwHighDateTime=0x1d5e723, ftLastAccessTime.dwLowDateTime=0x538533d0, ftLastAccessTime.dwHighDateTime=0x1d5e205, ftLastWriteTime.dwLowDateTime=0x538533d0, ftLastWriteTime.dwHighDateTime=0x1d5e205, nFileSizeHigh=0x0, nFileSizeLow=0x11bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="kr OW Wm3wK-XE06ET.png", cAlternateFileName="KROWWM~1.PNG")) returned 1 [0063.208] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a740d0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0x287b67e0, ftLastAccessTime.dwHighDateTime=0x1d5ecf0, ftLastWriteTime.dwLowDateTime=0x287b67e0, ftLastWriteTime.dwHighDateTime=0x1d5ecf0, nFileSizeHigh=0x0, nFileSizeLow=0xf187, dwReserved0=0x0, dwReserved1=0x0, cFileName="kxy6Jz9KDDhuF_7k.wav", cAlternateFileName="KXY6JZ~1.WAV")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe049a470, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0xc44d9430, ftLastAccessTime.dwHighDateTime=0x1d5e648, ftLastWriteTime.dwLowDateTime=0xc44d9430, ftLastWriteTime.dwHighDateTime=0x1d5e648, nFileSizeHigh=0x0, nFileSizeLow=0x1572f, dwReserved0=0x0, dwReserved1=0x0, cFileName="llU2Uku.wav", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceebf90, ftCreationTime.dwHighDateTime=0x1d5e4e3, ftLastAccessTime.dwLowDateTime=0xa3890c20, ftLastAccessTime.dwHighDateTime=0x1d5ecd3, ftLastWriteTime.dwLowDateTime=0xa3890c20, ftLastWriteTime.dwHighDateTime=0x1d5ecd3, nFileSizeHigh=0x0, nFileSizeLow=0x17636, dwReserved0=0x0, dwReserved1=0x0, cFileName="mFWpl6BM.m4a", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18addda0, ftCreationTime.dwHighDateTime=0x1d5e7a7, ftLastAccessTime.dwLowDateTime=0x4b724b90, ftLastAccessTime.dwHighDateTime=0x1d5eb8f, ftLastWriteTime.dwLowDateTime=0x4b724b90, ftLastWriteTime.dwHighDateTime=0x1d5eb8f, nFileSizeHigh=0x0, nFileSizeLow=0x90f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mWqj.pdf", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3affaed0, ftCreationTime.dwHighDateTime=0x1d5ebc4, ftLastAccessTime.dwLowDateTime=0xc71188c0, ftLastAccessTime.dwHighDateTime=0x1d5eea4, ftLastWriteTime.dwLowDateTime=0xc71188c0, ftLastWriteTime.dwHighDateTime=0x1d5eea4, nFileSizeHigh=0x0, nFileSizeLow=0xb67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFV2bR.m4a", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadeb85b0, ftCreationTime.dwHighDateTime=0x1d5e375, ftLastAccessTime.dwLowDateTime=0xaf6c3a20, ftLastAccessTime.dwHighDateTime=0x1d5ee69, ftLastWriteTime.dwLowDateTime=0xaf6c3a20, ftLastWriteTime.dwHighDateTime=0x1d5ee69, nFileSizeHigh=0x0, nFileSizeLow=0x7e25, dwReserved0=0x0, dwReserved1=0x0, cFileName="oJLMyx3.pps", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6cb0, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xdad57a10, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xdad57a10, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x15e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="olQrLaAp.mkv", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880623e0, ftCreationTime.dwHighDateTime=0x1d5e281, ftLastAccessTime.dwLowDateTime=0xeb833810, ftLastAccessTime.dwHighDateTime=0x1d5eb3f, ftLastWriteTime.dwLowDateTime=0xeb833810, ftLastWriteTime.dwHighDateTime=0x1d5eb3f, nFileSizeHigh=0x0, nFileSizeLow=0x73de, dwReserved0=0x0, dwReserved1=0x0, cFileName="oys2bm2JZJzuwj5.m4a", cAlternateFileName="OYS2BM~1.M4A")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7934280, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x133ae950, ftLastAccessTime.dwHighDateTime=0x1d5ee2b, ftLastWriteTime.dwLowDateTime=0x133ae950, ftLastWriteTime.dwHighDateTime=0x1d5ee2b, nFileSizeHigh=0x0, nFileSizeLow=0xcf70, dwReserved0=0x0, dwReserved1=0x0, cFileName="QG-y0HG.odp", cAlternateFileName="")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54ae040, ftCreationTime.dwHighDateTime=0x1d5e9ee, ftLastAccessTime.dwLowDateTime=0xa02290, ftLastAccessTime.dwHighDateTime=0x1d5edf6, ftLastWriteTime.dwLowDateTime=0xa02290, ftLastWriteTime.dwHighDateTime=0x1d5edf6, nFileSizeHigh=0x0, nFileSizeLow=0x11a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1B2uykrA-xFUmESK3Dq.pps", cAlternateFileName="S1B2UY~1.PPS")) returned 1 [0063.209] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa616e5a0, ftCreationTime.dwHighDateTime=0x1d5ee15, ftLastAccessTime.dwLowDateTime=0xbec2d40, ftLastAccessTime.dwHighDateTime=0x1d5f0d7, ftLastWriteTime.dwLowDateTime=0xbec2d40, ftLastWriteTime.dwHighDateTime=0x1d5f0d7, nFileSizeHigh=0x0, nFileSizeLow=0x12fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-c8vmX_KEfWZm.jpg", cAlternateFileName="TR-C8V~1.JPG")) returned 1 [0063.210] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfccafc0, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x201998c0, ftLastAccessTime.dwHighDateTime=0x1d5e786, ftLastWriteTime.dwLowDateTime=0x201998c0, ftLastWriteTime.dwHighDateTime=0x1d5e786, nFileSizeHigh=0x0, nFileSizeLow=0x1057d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TtSxTSGDujQAS7.pptx", cAlternateFileName="TTSXTS~1.PPT")) returned 1 [0063.210] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4feedf0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0xb822a9d0, ftLastAccessTime.dwHighDateTime=0x1d5e278, ftLastWriteTime.dwLowDateTime=0xb822a9d0, ftLastWriteTime.dwHighDateTime=0x1d5e278, nFileSizeHigh=0x0, nFileSizeLow=0x17816, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6tyP6Iy.docx", cAlternateFileName="U6TYP6~1.DOC")) returned 1 [0063.210] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7b9480, ftCreationTime.dwHighDateTime=0x1d5e6ed, ftLastAccessTime.dwLowDateTime=0xc9edf410, ftLastAccessTime.dwHighDateTime=0x1d5e388, ftLastWriteTime.dwLowDateTime=0xc9edf410, ftLastWriteTime.dwHighDateTime=0x1d5e388, nFileSizeHigh=0x0, nFileSizeLow=0x89f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucS1WZ_jP85kZbpvf.bmp", cAlternateFileName="UCS1WZ~1.BMP")) returned 1 [0063.211] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d83490, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x335d4080, ftLastAccessTime.dwHighDateTime=0x1d5ef4c, ftLastWriteTime.dwLowDateTime=0x335d4080, ftLastWriteTime.dwHighDateTime=0x1d5ef4c, nFileSizeHigh=0x0, nFileSizeLow=0x6cd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="vBWk.png", cAlternateFileName="")) returned 1 [0063.211] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80780290, ftCreationTime.dwHighDateTime=0x1d5e756, ftLastAccessTime.dwLowDateTime=0xc6797cd0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xc6797cd0, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x6cf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vR8JQ2rMtXN04OJZSmW.jpg", cAlternateFileName="VR8JQ2~1.JPG")) returned 1 [0063.212] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146bdae0, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0x4155b180, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x4155b180, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x6de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vU91-Ro6yaJRH.png", cAlternateFileName="VU91-R~1.PNG")) returned 1 [0063.212] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6caf1f0, ftCreationTime.dwHighDateTime=0x1d5ec9e, ftLastAccessTime.dwLowDateTime=0xb4018000, ftLastAccessTime.dwHighDateTime=0x1d5ecc4, ftLastWriteTime.dwLowDateTime=0xb4018000, ftLastWriteTime.dwHighDateTime=0x1d5ecc4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W QTGY", cAlternateFileName="WQTGY~1")) returned 1 [0063.213] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6e8a70, ftCreationTime.dwHighDateTime=0x1d5eeb3, ftLastAccessTime.dwLowDateTime=0xc57709f0, ftLastAccessTime.dwHighDateTime=0x1d5eb33, ftLastWriteTime.dwLowDateTime=0xc57709f0, ftLastWriteTime.dwHighDateTime=0x1d5eb33, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIK08-nVSPmTVXo3Fn.gif", cAlternateFileName="WIK08-~1.GIF")) returned 1 [0063.213] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20155900, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x20155900, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x1ee42c00, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x31400, dwReserved0=0x0, dwReserved1=0x0, cFileName="xX.exe", cAlternateFileName="")) returned 1 [0063.213] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7eb33f0, ftCreationTime.dwHighDateTime=0x1d5e849, ftLastAccessTime.dwLowDateTime=0xa5c1bc20, ftLastAccessTime.dwHighDateTime=0x1d5f107, ftLastWriteTime.dwLowDateTime=0xa5c1bc20, ftLastWriteTime.dwHighDateTime=0x1d5f107, nFileSizeHigh=0x0, nFileSizeLow=0x187a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YiAHYyhfj8F7D2aEl.mkv", cAlternateFileName="YIAHYY~1.MKV")) returned 1 [0063.213] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f111100, ftCreationTime.dwHighDateTime=0x1d5ef22, ftLastAccessTime.dwLowDateTime=0xcaa3b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0xcaa3b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x1695, dwReserved0=0x0, dwReserved1=0x0, cFileName="_MfhYDoXR1 v.flv", cAlternateFileName="_MFHYD~1.FLV")) returned 1 [0063.213] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0063.213] FindClose (in: hFindFile=0x125f7e8 | out: hFindFile=0x125f7e8) returned 1 [0063.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0063.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0063.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0063.213] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\", lpFilePart=0x0) returned 0x18 [0063.214] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2ddc2fa1, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x2ddc2fa1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x125f7e8 [0063.214] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2ddc2fa1, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x2ddc2fa1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0dea20, ftCreationTime.dwHighDateTime=0x1d5eabb, ftLastAccessTime.dwLowDateTime=0xe4aa04c0, ftLastAccessTime.dwHighDateTime=0x1d5e5d5, ftLastWriteTime.dwLowDateTime=0xe4aa04c0, ftLastWriteTime.dwHighDateTime=0x1d5e5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="0V5ASM9JptEW4M8.png", cAlternateFileName="0V5ASM~1.PNG")) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df4b9d0, ftCreationTime.dwHighDateTime=0x1d5e70c, ftLastAccessTime.dwLowDateTime=0xdfc48300, ftLastAccessTime.dwHighDateTime=0x1d5f0f1, ftLastWriteTime.dwLowDateTime=0xdfc48300, ftLastWriteTime.dwHighDateTime=0x1d5f0f1, nFileSizeHigh=0x0, nFileSizeLow=0x1673d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C9KWd2EC.jpg", cAlternateFileName="2C9KWD~1.JPG")) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886d94b0, ftCreationTime.dwHighDateTime=0x1d5e986, ftLastAccessTime.dwLowDateTime=0x3f120260, ftLastAccessTime.dwHighDateTime=0x1d5e1b6, ftLastWriteTime.dwLowDateTime=0x3f120260, ftLastWriteTime.dwHighDateTime=0x1d5e1b6, nFileSizeHigh=0x0, nFileSizeLow=0x117cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="6GJxgoamnWHGbtl-7q.doc", cAlternateFileName="6GJXGO~1.DOC")) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6680aab0, ftCreationTime.dwHighDateTime=0x1d5e678, ftLastAccessTime.dwLowDateTime=0xb60f5bd0, ftLastAccessTime.dwHighDateTime=0x1d5ebdc, ftLastWriteTime.dwLowDateTime=0xb60f5bd0, ftLastWriteTime.dwHighDateTime=0x1d5ebdc, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bai6sTP0gHGTAw4Szx.gif", cAlternateFileName="BAI6ST~1.GIF")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x475c7620, ftCreationTime.dwHighDateTime=0x1d5e284, ftLastAccessTime.dwLowDateTime=0x86f2be30, ftLastAccessTime.dwHighDateTime=0x1d5e0b7, ftLastWriteTime.dwLowDateTime=0x86f2be30, ftLastWriteTime.dwHighDateTime=0x1d5e0b7, nFileSizeHigh=0x0, nFileSizeLow=0xfeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMeIHrHrTt.swf", cAlternateFileName="CMEIHR~1.SWF")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af86550, ftCreationTime.dwHighDateTime=0x1d5e31e, ftLastAccessTime.dwLowDateTime=0x5e88e730, ftLastAccessTime.dwHighDateTime=0x1d5efe4, ftLastWriteTime.dwLowDateTime=0x5e88e730, ftLastWriteTime.dwHighDateTime=0x1d5efe4, nFileSizeHigh=0x0, nFileSizeLow=0x171a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dutcK49w7 8.wav", cAlternateFileName="DUTCK4~1.WAV")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7214e750, ftCreationTime.dwHighDateTime=0x1d5e96c, ftLastAccessTime.dwLowDateTime=0xf3f19230, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0xf3f19230, ftLastWriteTime.dwHighDateTime=0x1d5e815, nFileSizeHigh=0x0, nFileSizeLow=0xfd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EV5Wd a.jpg", cAlternateFileName="EV5WDA~1.JPG")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28cbda0, ftCreationTime.dwHighDateTime=0x1d5eb40, ftLastAccessTime.dwLowDateTime=0x6b7b4270, ftLastAccessTime.dwHighDateTime=0x1d5e78e, ftLastWriteTime.dwLowDateTime=0x6b7b4270, ftLastWriteTime.dwHighDateTime=0x1d5e78e, nFileSizeHigh=0x0, nFileSizeLow=0xb292, dwReserved0=0x0, dwReserved1=0x0, cFileName="GkuS.docx", cAlternateFileName="GKUS~1.DOC")) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70efd040, ftCreationTime.dwHighDateTime=0x1d5e432, ftLastAccessTime.dwLowDateTime=0xd2298670, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0xd2298670, ftLastWriteTime.dwHighDateTime=0x1d5e695, nFileSizeHigh=0x0, nFileSizeLow=0xfaa6, dwReserved0=0x0, dwReserved1=0x0, cFileName="iKSiSRxDBr2gdWg8.gif", cAlternateFileName="IKSISR~1.GIF")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5758880, ftCreationTime.dwHighDateTime=0x1d5e1fa, ftLastAccessTime.dwLowDateTime=0x4327a300, ftLastAccessTime.dwHighDateTime=0x1d5e5da, ftLastWriteTime.dwLowDateTime=0x4327a300, ftLastWriteTime.dwHighDateTime=0x1d5e5da, nFileSizeHigh=0x0, nFileSizeLow=0xc910, dwReserved0=0x0, dwReserved1=0x0, cFileName="iR1vMzL3ZLw0J V2.jpg", cAlternateFileName="IR1VMZ~1.JPG")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57db0a0, ftCreationTime.dwHighDateTime=0x1d5e862, ftLastAccessTime.dwLowDateTime=0x59926ab0, ftLastAccessTime.dwHighDateTime=0x1d5e816, ftLastWriteTime.dwLowDateTime=0x59926ab0, ftLastWriteTime.dwHighDateTime=0x1d5e816, nFileSizeHigh=0x0, nFileSizeLow=0x8ccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjpZ4inX8eFdXTD.ots", cAlternateFileName="JJPZ4I~1.OTS")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b38c0, ftCreationTime.dwHighDateTime=0x1d5e7cd, ftLastAccessTime.dwLowDateTime=0x412121b0, ftLastAccessTime.dwHighDateTime=0x1d5eefb, ftLastWriteTime.dwLowDateTime=0x412121b0, ftLastWriteTime.dwHighDateTime=0x1d5eefb, nFileSizeHigh=0x0, nFileSizeLow=0x650f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jOPLa0 DCGPa4J.swf", cAlternateFileName="JOPLA0~1.SWF")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb03d230, ftCreationTime.dwHighDateTime=0x1d5e723, ftLastAccessTime.dwLowDateTime=0x538533d0, ftLastAccessTime.dwHighDateTime=0x1d5e205, ftLastWriteTime.dwLowDateTime=0x538533d0, ftLastWriteTime.dwHighDateTime=0x1d5e205, nFileSizeHigh=0x0, nFileSizeLow=0x11bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="kr OW Wm3wK-XE06ET.png", cAlternateFileName="KROWWM~1.PNG")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a740d0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0x287b67e0, ftLastAccessTime.dwHighDateTime=0x1d5ecf0, ftLastWriteTime.dwLowDateTime=0x287b67e0, ftLastWriteTime.dwHighDateTime=0x1d5ecf0, nFileSizeHigh=0x0, nFileSizeLow=0xf187, dwReserved0=0x0, dwReserved1=0x0, cFileName="kxy6Jz9KDDhuF_7k.wav", cAlternateFileName="KXY6JZ~1.WAV")) returned 1 [0063.216] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe049a470, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0xc44d9430, ftLastAccessTime.dwHighDateTime=0x1d5e648, ftLastWriteTime.dwLowDateTime=0xc44d9430, ftLastWriteTime.dwHighDateTime=0x1d5e648, nFileSizeHigh=0x0, nFileSizeLow=0x1572f, dwReserved0=0x0, dwReserved1=0x0, cFileName="llU2Uku.wav", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceebf90, ftCreationTime.dwHighDateTime=0x1d5e4e3, ftLastAccessTime.dwLowDateTime=0xa3890c20, ftLastAccessTime.dwHighDateTime=0x1d5ecd3, ftLastWriteTime.dwLowDateTime=0xa3890c20, ftLastWriteTime.dwHighDateTime=0x1d5ecd3, nFileSizeHigh=0x0, nFileSizeLow=0x17636, dwReserved0=0x0, dwReserved1=0x0, cFileName="mFWpl6BM.m4a", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18addda0, ftCreationTime.dwHighDateTime=0x1d5e7a7, ftLastAccessTime.dwLowDateTime=0x4b724b90, ftLastAccessTime.dwHighDateTime=0x1d5eb8f, ftLastWriteTime.dwLowDateTime=0x4b724b90, ftLastWriteTime.dwHighDateTime=0x1d5eb8f, nFileSizeHigh=0x0, nFileSizeLow=0x90f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="mWqj.pdf", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3affaed0, ftCreationTime.dwHighDateTime=0x1d5ebc4, ftLastAccessTime.dwLowDateTime=0xc71188c0, ftLastAccessTime.dwHighDateTime=0x1d5eea4, ftLastWriteTime.dwLowDateTime=0xc71188c0, ftLastWriteTime.dwHighDateTime=0x1d5eea4, nFileSizeHigh=0x0, nFileSizeLow=0xb67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFV2bR.m4a", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadeb85b0, ftCreationTime.dwHighDateTime=0x1d5e375, ftLastAccessTime.dwLowDateTime=0xaf6c3a20, ftLastAccessTime.dwHighDateTime=0x1d5ee69, ftLastWriteTime.dwLowDateTime=0xaf6c3a20, ftLastWriteTime.dwHighDateTime=0x1d5ee69, nFileSizeHigh=0x0, nFileSizeLow=0x7e25, dwReserved0=0x0, dwReserved1=0x0, cFileName="oJLMyx3.pps", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6cb0, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xdad57a10, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0xdad57a10, ftLastWriteTime.dwHighDateTime=0x1d5e350, nFileSizeHigh=0x0, nFileSizeLow=0x15e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="olQrLaAp.mkv", cAlternateFileName="")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880623e0, ftCreationTime.dwHighDateTime=0x1d5e281, ftLastAccessTime.dwLowDateTime=0xeb833810, ftLastAccessTime.dwHighDateTime=0x1d5eb3f, ftLastWriteTime.dwLowDateTime=0xeb833810, ftLastWriteTime.dwHighDateTime=0x1d5eb3f, nFileSizeHigh=0x0, nFileSizeLow=0x73de, dwReserved0=0x0, dwReserved1=0x0, cFileName="oys2bm2JZJzuwj5.m4a", cAlternateFileName="OYS2BM~1.M4A")) returned 1 [0063.217] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7934280, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x133ae950, ftLastAccessTime.dwHighDateTime=0x1d5ee2b, ftLastWriteTime.dwLowDateTime=0x133ae950, ftLastWriteTime.dwHighDateTime=0x1d5ee2b, nFileSizeHigh=0x0, nFileSizeLow=0xcf70, dwReserved0=0x0, dwReserved1=0x0, cFileName="QG-y0HG.odp", cAlternateFileName="")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd54ae040, ftCreationTime.dwHighDateTime=0x1d5e9ee, ftLastAccessTime.dwLowDateTime=0xa02290, ftLastAccessTime.dwHighDateTime=0x1d5edf6, ftLastWriteTime.dwLowDateTime=0xa02290, ftLastWriteTime.dwHighDateTime=0x1d5edf6, nFileSizeHigh=0x0, nFileSizeLow=0x11a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="S1B2uykrA-xFUmESK3Dq.pps", cAlternateFileName="S1B2UY~1.PPS")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa616e5a0, ftCreationTime.dwHighDateTime=0x1d5ee15, ftLastAccessTime.dwLowDateTime=0xbec2d40, ftLastAccessTime.dwHighDateTime=0x1d5f0d7, ftLastWriteTime.dwLowDateTime=0xbec2d40, ftLastWriteTime.dwHighDateTime=0x1d5f0d7, nFileSizeHigh=0x0, nFileSizeLow=0x12fea, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-c8vmX_KEfWZm.jpg", cAlternateFileName="TR-C8V~1.JPG")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfccafc0, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x201998c0, ftLastAccessTime.dwHighDateTime=0x1d5e786, ftLastWriteTime.dwLowDateTime=0x201998c0, ftLastWriteTime.dwHighDateTime=0x1d5e786, nFileSizeHigh=0x0, nFileSizeLow=0x1057d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TtSxTSGDujQAS7.pptx", cAlternateFileName="TTSXTS~1.PPT")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4feedf0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0xb822a9d0, ftLastAccessTime.dwHighDateTime=0x1d5e278, ftLastWriteTime.dwLowDateTime=0xb822a9d0, ftLastWriteTime.dwHighDateTime=0x1d5e278, nFileSizeHigh=0x0, nFileSizeLow=0x17816, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6tyP6Iy.docx", cAlternateFileName="U6TYP6~1.DOC")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7b9480, ftCreationTime.dwHighDateTime=0x1d5e6ed, ftLastAccessTime.dwLowDateTime=0xc9edf410, ftLastAccessTime.dwHighDateTime=0x1d5e388, ftLastWriteTime.dwLowDateTime=0xc9edf410, ftLastWriteTime.dwHighDateTime=0x1d5e388, nFileSizeHigh=0x0, nFileSizeLow=0x89f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucS1WZ_jP85kZbpvf.bmp", cAlternateFileName="UCS1WZ~1.BMP")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d83490, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x335d4080, ftLastAccessTime.dwHighDateTime=0x1d5ef4c, ftLastWriteTime.dwLowDateTime=0x335d4080, ftLastWriteTime.dwHighDateTime=0x1d5ef4c, nFileSizeHigh=0x0, nFileSizeLow=0x6cd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="vBWk.png", cAlternateFileName="")) returned 1 [0063.218] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80780290, ftCreationTime.dwHighDateTime=0x1d5e756, ftLastAccessTime.dwLowDateTime=0xc6797cd0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xc6797cd0, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x6cf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vR8JQ2rMtXN04OJZSmW.jpg", cAlternateFileName="VR8JQ2~1.JPG")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146bdae0, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0x4155b180, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x4155b180, ftLastWriteTime.dwHighDateTime=0x1d5e30e, nFileSizeHigh=0x0, nFileSizeLow=0x6de7, dwReserved0=0x0, dwReserved1=0x0, cFileName="vU91-Ro6yaJRH.png", cAlternateFileName="VU91-R~1.PNG")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6caf1f0, ftCreationTime.dwHighDateTime=0x1d5ec9e, ftLastAccessTime.dwLowDateTime=0xb4018000, ftLastAccessTime.dwHighDateTime=0x1d5ecc4, ftLastWriteTime.dwLowDateTime=0xb4018000, ftLastWriteTime.dwHighDateTime=0x1d5ecc4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="W QTGY", cAlternateFileName="WQTGY~1")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6e8a70, ftCreationTime.dwHighDateTime=0x1d5eeb3, ftLastAccessTime.dwLowDateTime=0xc57709f0, ftLastAccessTime.dwHighDateTime=0x1d5eb33, ftLastWriteTime.dwLowDateTime=0xc57709f0, ftLastWriteTime.dwHighDateTime=0x1d5eb33, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIK08-nVSPmTVXo3Fn.gif", cAlternateFileName="WIK08-~1.GIF")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20155900, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x20155900, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x1ee42c00, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x31400, dwReserved0=0x0, dwReserved1=0x0, cFileName="xX.exe", cAlternateFileName="")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7eb33f0, ftCreationTime.dwHighDateTime=0x1d5e849, ftLastAccessTime.dwLowDateTime=0xa5c1bc20, ftLastAccessTime.dwHighDateTime=0x1d5f107, ftLastWriteTime.dwLowDateTime=0xa5c1bc20, ftLastWriteTime.dwHighDateTime=0x1d5f107, nFileSizeHigh=0x0, nFileSizeLow=0x187a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YiAHYyhfj8F7D2aEl.mkv", cAlternateFileName="YIAHYY~1.MKV")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f111100, ftCreationTime.dwHighDateTime=0x1d5ef22, ftLastAccessTime.dwLowDateTime=0xcaa3b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0xcaa3b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x1695, dwReserved0=0x0, dwReserved1=0x0, cFileName="_MfhYDoXR1 v.flv", cAlternateFileName="_MFHYD~1.FLV")) returned 1 [0063.219] FindNextFileW (in: hFindFile=0x125f7e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f111100, ftCreationTime.dwHighDateTime=0x1d5ef22, ftLastAccessTime.dwLowDateTime=0xcaa3b2a0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0xcaa3b2a0, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x1695, dwReserved0=0x0, dwReserved1=0x0, cFileName="_MfhYDoXR1 v.flv", cAlternateFileName="_MFHYD~1.FLV")) returned 0 [0063.220] FindClose (in: hFindFile=0x125f7e8 | out: hFindFile=0x125f7e8) returned 1 [0063.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0063.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0063.233] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", lpFilePart=0x0) returned 0x2b [0063.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0063.233] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0v5asm9jptew4m8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x538 [0063.234] GetFileType (hFile=0x538) returned 0x1 [0063.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0063.234] GetFileType (hFile=0x538) returned 0x1 [0063.234] GetFileSize (in: hFile=0x538, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xdbc7 [0063.235] ReadFile (in: hFile=0x538, lpBuffer=0x2df5c38, nNumberOfBytesToRead=0xdbc7, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2df5c38*, lpNumberOfBytesRead=0xefece8*=0xdbc7, lpOverlapped=0x0) returned 1 [0063.235] CloseHandle (hObject=0x538) returned 1 [0063.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe690, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0063.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0xefe6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0063.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba8) returned 1 [0063.472] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0xefec24 | out: lpFileInformation=0xefec24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0063.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba4) returned 1 [0063.702] BCryptGetFipsAlgorithmMode (in: pfEnabled=0xefeb00 | out: pfEnabled=0xefeb00) returned 0x0 [0064.279] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", lpFilePart=0x0) returned 0x2b [0064.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0064.279] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0v5asm9jptew4m8.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.282] GetFileType (hFile=0x584) returned 0x1 [0064.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0064.282] GetFileType (hFile=0x584) returned 0x1 [0064.282] WriteFile (in: hFile=0x584, lpBuffer=0x2e961a0*, nNumberOfBytesToWrite=0xdbd0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e961a0*, lpNumberOfBytesWritten=0xefecdc*=0xdbd0, lpOverlapped=0x0) returned 1 [0064.284] CloseHandle (hObject=0x584) returned 1 [0064.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png", lpFilePart=0x0) returned 0x2b [0064.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png.wholocked", lpFilePart=0x0) returned 0x35 [0064.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0064.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0v5asm9jptew4m8.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce0dea20, ftCreationTime.dwHighDateTime=0x1d5eabb, ftLastAccessTime.dwLowDateTime=0xe4aa04c0, ftLastAccessTime.dwHighDateTime=0x1d5e5d5, ftLastWriteTime.dwLowDateTime=0x47b951c0, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xdbd0)) returned 1 [0064.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0064.287] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png" (normalized: "c:\\users\\fd1hvy\\desktop\\0v5asm9jptew4m8.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0V5ASM9JptEW4M8.png.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\0v5asm9jptew4m8.png.wholocked")) returned 1 [0064.289] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", lpFilePart=0x0) returned 0x25 [0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0064.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\2c9kwd2ec.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.289] GetFileType (hFile=0x584) returned 0x1 [0064.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0064.289] GetFileType (hFile=0x584) returned 0x1 [0064.289] GetFileSize (in: hFile=0x584, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1673d [0064.290] ReadFile (in: hFile=0x584, lpBuffer=0x3dcd608, nNumberOfBytesToRead=0x1673d, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3dcd608*, lpNumberOfBytesRead=0xefece8*=0x1673d, lpOverlapped=0x0) returned 1 [0064.344] CloseHandle (hObject=0x584) returned 1 [0064.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", lpFilePart=0x0) returned 0x25 [0064.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0064.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\2c9kwd2ec.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.500] GetFileType (hFile=0x584) returned 0x1 [0064.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0064.500] GetFileType (hFile=0x584) returned 0x1 [0064.500] WriteFile (in: hFile=0x584, lpBuffer=0x3e3da88*, nNumberOfBytesToWrite=0x16740, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3e3da88*, lpNumberOfBytesWritten=0xefecdc*=0x16740, lpOverlapped=0x0) returned 1 [0064.503] CloseHandle (hObject=0x584) returned 1 [0064.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg", lpFilePart=0x0) returned 0x25 [0064.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg.wholocked", lpFilePart=0x0) returned 0x2f [0064.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0064.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\2c9kwd2ec.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df4b9d0, ftCreationTime.dwHighDateTime=0x1d5e70c, ftLastAccessTime.dwLowDateTime=0xdfc48300, ftLastAccessTime.dwHighDateTime=0x1d5f0f1, ftLastWriteTime.dwLowDateTime=0x47dc0307, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x16740)) returned 1 [0064.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0064.552] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\2c9kwd2ec.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\2C9KWd2EC.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\2c9kwd2ec.jpg.wholocked")) returned 1 [0064.620] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", lpFilePart=0x0) returned 0x2e [0064.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0064.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6gjxgoamnwhgbtl-7q.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.620] GetFileType (hFile=0x584) returned 0x1 [0064.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0064.620] GetFileType (hFile=0x584) returned 0x1 [0064.620] GetFileSize (in: hFile=0x584, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x117cb [0064.621] ReadFile (in: hFile=0x584, lpBuffer=0x2ef11dc, nNumberOfBytesToRead=0x117cb, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ef11dc*, lpNumberOfBytesRead=0xefece8*=0x117cb, lpOverlapped=0x0) returned 1 [0064.622] CloseHandle (hObject=0x584) returned 1 [0064.739] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", lpFilePart=0x0) returned 0x2e [0064.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0064.739] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6gjxgoamnwhgbtl-7q.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.825] GetFileType (hFile=0x584) returned 0x1 [0064.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0064.825] GetFileType (hFile=0x584) returned 0x1 [0064.825] WriteFile (in: hFile=0x584, lpBuffer=0x2f7274c*, nNumberOfBytesToWrite=0x117d0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f7274c*, lpNumberOfBytesWritten=0xefecdc*=0x117d0, lpOverlapped=0x0) returned 1 [0064.843] CloseHandle (hObject=0x584) returned 1 [0064.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc", lpFilePart=0x0) returned 0x2e [0064.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc.wholocked", lpFilePart=0x0) returned 0x38 [0064.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0064.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6gjxgoamnwhgbtl-7q.doc"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886d94b0, ftCreationTime.dwHighDateTime=0x1d5e986, ftLastAccessTime.dwLowDateTime=0x3f120260, ftLastAccessTime.dwHighDateTime=0x1d5e1b6, ftLastWriteTime.dwLowDateTime=0x480f2b42, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x117d0)) returned 1 [0064.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0064.903] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6gjxgoamnwhgbtl-7q.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6GJxgoamnWHGbtl-7q.doc.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\6gjxgoamnwhgbtl-7q.doc.wholocked")) returned 1 [0064.949] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", lpFilePart=0x0) returned 0x27 [0064.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0064.949] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dutck49w7 8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x584 [0064.950] GetFileType (hFile=0x584) returned 0x1 [0064.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0064.950] GetFileType (hFile=0x584) returned 0x1 [0064.950] GetFileSize (in: hFile=0x584, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x171a [0064.950] ReadFile (in: hFile=0x584, lpBuffer=0x2f842dc, nNumberOfBytesToRead=0x171a, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f842dc*, lpNumberOfBytesRead=0xefece8*=0x171a, lpOverlapped=0x0) returned 1 [0064.950] CloseHandle (hObject=0x584) returned 1 [0065.262] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", lpFilePart=0x0) returned 0x27 [0065.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0065.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dutck49w7 8.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0065.310] GetFileType (hFile=0x354) returned 0x1 [0065.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0065.310] GetFileType (hFile=0x354) returned 0x1 [0065.310] WriteFile (in: hFile=0x354, lpBuffer=0x2e16b1c*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e16b1c*, lpNumberOfBytesWritten=0xefecdc*=0x1720, lpOverlapped=0x0) returned 1 [0065.311] CloseHandle (hObject=0x354) returned 1 [0065.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav", lpFilePart=0x0) returned 0x27 [0065.359] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav.wholocked", lpFilePart=0x0) returned 0x31 [0065.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0065.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dutck49w7 8.wav"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af86550, ftCreationTime.dwHighDateTime=0x1d5e31e, ftLastAccessTime.dwLowDateTime=0x5e88e730, ftLastAccessTime.dwHighDateTime=0x1d5efe4, ftLastWriteTime.dwLowDateTime=0x4856d37b, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x1720)) returned 1 [0065.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0065.360] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\dutck49w7 8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\dutcK49w7 8.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\dutck49w7 8.wav.wholocked")) returned 1 [0065.424] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", lpFilePart=0x0) returned 0x23 [0065.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0065.424] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ev5wd a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0065.424] GetFileType (hFile=0x354) returned 0x1 [0065.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0065.424] GetFileType (hFile=0x354) returned 0x1 [0065.424] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xfd6e [0065.424] ReadFile (in: hFile=0x354, lpBuffer=0x2e18554, nNumberOfBytesToRead=0xfd6e, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e18554*, lpNumberOfBytesRead=0xefece8*=0xfd6e, lpOverlapped=0x0) returned 1 [0065.425] CloseHandle (hObject=0x354) returned 1 [0065.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", lpFilePart=0x0) returned 0x23 [0065.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0065.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ev5wd a.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0065.609] GetFileType (hFile=0x354) returned 0x1 [0065.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0065.609] GetFileType (hFile=0x354) returned 0x1 [0065.609] WriteFile (in: hFile=0x354, lpBuffer=0x2e94d00*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e94d00*, lpNumberOfBytesWritten=0xefecdc*=0xfd70, lpOverlapped=0x0) returned 1 [0065.611] CloseHandle (hObject=0x354) returned 1 [0065.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg", lpFilePart=0x0) returned 0x23 [0065.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg.wholocked", lpFilePart=0x0) returned 0x2d [0065.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0065.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ev5wd a.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7214e750, ftCreationTime.dwHighDateTime=0x1d5e96c, ftLastAccessTime.dwLowDateTime=0xf3f19230, ftLastAccessTime.dwHighDateTime=0x1d5e815, ftLastWriteTime.dwLowDateTime=0x4883ff18, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xfd70)) returned 1 [0065.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0065.748] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ev5wd a.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\EV5Wd a.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\ev5wd a.jpg.wholocked")) returned 1 [0065.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", lpFilePart=0x0) returned 0x21 [0065.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0065.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\gkus.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0065.795] GetFileType (hFile=0x354) returned 0x1 [0065.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0065.795] GetFileType (hFile=0x354) returned 0x1 [0065.795] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xb292 [0065.795] ReadFile (in: hFile=0x354, lpBuffer=0x2ea4d58, nNumberOfBytesToRead=0xb292, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ea4d58*, lpNumberOfBytesRead=0xefece8*=0xb292, lpOverlapped=0x0) returned 1 [0065.796] CloseHandle (hObject=0x354) returned 1 [0065.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", lpFilePart=0x0) returned 0x21 [0065.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0065.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\gkus.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0065.886] GetFileType (hFile=0x354) returned 0x1 [0065.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0065.886] GetFileType (hFile=0x354) returned 0x1 [0065.886] WriteFile (in: hFile=0x354, lpBuffer=0x2f13338*, nNumberOfBytesToWrite=0xb2a0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f13338*, lpNumberOfBytesWritten=0xefecdc*=0xb2a0, lpOverlapped=0x0) returned 1 [0065.888] CloseHandle (hObject=0x354) returned 1 [0066.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx", lpFilePart=0x0) returned 0x21 [0066.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx.wholocked", lpFilePart=0x0) returned 0x2b [0066.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\gkus.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28cbda0, ftCreationTime.dwHighDateTime=0x1d5eb40, ftLastAccessTime.dwLowDateTime=0x6b7b4270, ftLastAccessTime.dwHighDateTime=0x1d5e78e, ftLastWriteTime.dwLowDateTime=0x48aee92e, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xb2a0)) returned 1 [0066.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\gkus.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GkuS.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\gkus.docx.wholocked")) returned 1 [0066.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", lpFilePart=0x0) returned 0x2c [0066.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ir1vmzl3zlw0j v2.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.081] GetFileType (hFile=0x354) returned 0x1 [0066.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.081] GetFileType (hFile=0x354) returned 0x1 [0066.081] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xc910 [0066.081] ReadFile (in: hFile=0x354, lpBuffer=0x2f1e8f4, nNumberOfBytesToRead=0xc910, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f1e8f4*, lpNumberOfBytesRead=0xefece8*=0xc910, lpOverlapped=0x0) returned 1 [0066.081] CloseHandle (hObject=0x354) returned 1 [0066.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", lpFilePart=0x0) returned 0x2c [0066.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ir1vmzl3zlw0j v2.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.263] GetFileType (hFile=0x354) returned 0x1 [0066.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.263] GetFileType (hFile=0x354) returned 0x1 [0066.263] WriteFile (in: hFile=0x354, lpBuffer=0x2f91250*, nNumberOfBytesToWrite=0xc920, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f91250*, lpNumberOfBytesWritten=0xefecdc*=0xc920, lpOverlapped=0x0) returned 1 [0066.265] CloseHandle (hObject=0x354) returned 1 [0066.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg", lpFilePart=0x0) returned 0x2c [0066.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg.wholocked", lpFilePart=0x0) returned 0x36 [0066.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ir1vmzl3zlw0j v2.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5758880, ftCreationTime.dwHighDateTime=0x1d5e1fa, ftLastAccessTime.dwLowDateTime=0x4327a300, ftLastAccessTime.dwHighDateTime=0x1d5e5da, ftLastWriteTime.dwLowDateTime=0x48e8216f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xc920)) returned 1 [0066.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.267] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ir1vmzl3zlw0j v2.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\iR1vMzL3ZLw0J V2.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\ir1vmzl3zlw0j v2.jpg.wholocked")) returned 1 [0066.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", lpFilePart=0x0) returned 0x2e [0066.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kr ow wm3wk-xe06et.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.268] GetFileType (hFile=0x354) returned 0x1 [0066.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.268] GetFileType (hFile=0x354) returned 0x1 [0066.268] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x11bb4 [0066.269] ReadFile (in: hFile=0x354, lpBuffer=0x2f9df24, nNumberOfBytesToRead=0x11bb4, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f9df24*, lpNumberOfBytesRead=0xefece8*=0x11bb4, lpOverlapped=0x0) returned 1 [0066.270] CloseHandle (hObject=0x354) returned 1 [0066.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", lpFilePart=0x0) returned 0x2e [0066.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kr ow wm3wk-xe06et.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.389] GetFileType (hFile=0x354) returned 0x1 [0066.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.389] GetFileType (hFile=0x354) returned 0x1 [0066.389] WriteFile (in: hFile=0x354, lpBuffer=0x2e337cc*, nNumberOfBytesToWrite=0x11bc0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e337cc*, lpNumberOfBytesWritten=0xefecdc*=0x11bc0, lpOverlapped=0x0) returned 1 [0066.391] CloseHandle (hObject=0x354) returned 1 [0066.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png", lpFilePart=0x0) returned 0x2e [0066.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png.wholocked", lpFilePart=0x0) returned 0x38 [0066.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.394] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kr ow wm3wk-xe06et.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb03d230, ftCreationTime.dwHighDateTime=0x1d5e723, ftLastAccessTime.dwLowDateTime=0x538533d0, ftLastAccessTime.dwHighDateTime=0x1d5e205, ftLastWriteTime.dwLowDateTime=0x48fb3202, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x11bc0)) returned 1 [0066.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.394] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png" (normalized: "c:\\users\\fd1hvy\\desktop\\kr ow wm3wk-xe06et.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kr OW Wm3wK-XE06ET.png.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\kr ow wm3wk-xe06et.png.wholocked")) returned 1 [0066.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", lpFilePart=0x0) returned 0x2c [0066.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kxy6jz9kddhuf_7k.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.394] GetFileType (hFile=0x354) returned 0x1 [0066.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.395] GetFileType (hFile=0x354) returned 0x1 [0066.395] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xf187 [0066.395] ReadFile (in: hFile=0x354, lpBuffer=0x2e4571c, nNumberOfBytesToRead=0xf187, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e4571c*, lpNumberOfBytesRead=0xefece8*=0xf187, lpOverlapped=0x0) returned 1 [0066.395] CloseHandle (hObject=0x354) returned 1 [0066.415] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", lpFilePart=0x0) returned 0x2c [0066.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kxy6jz9kddhuf_7k.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.484] GetFileType (hFile=0x354) returned 0x1 [0066.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.485] GetFileType (hFile=0x354) returned 0x1 [0066.485] WriteFile (in: hFile=0x354, lpBuffer=0x2ebfb28*, nNumberOfBytesToWrite=0xf190, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ebfb28*, lpNumberOfBytesWritten=0xefecdc*=0xf190, lpOverlapped=0x0) returned 1 [0066.487] CloseHandle (hObject=0x354) returned 1 [0066.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav", lpFilePart=0x0) returned 0x2c [0066.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav.wholocked", lpFilePart=0x0) returned 0x36 [0066.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kxy6jz9kddhuf_7k.wav"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6a740d0, ftCreationTime.dwHighDateTime=0x1d5f048, ftLastAccessTime.dwLowDateTime=0x287b67e0, ftLastAccessTime.dwHighDateTime=0x1d5ecf0, ftLastWriteTime.dwLowDateTime=0x49097ffb, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xf190)) returned 1 [0066.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.490] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kxy6jz9kddhuf_7k.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kxy6Jz9KDDhuF_7k.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\kxy6jz9kddhuf_7k.wav.wholocked")) returned 1 [0066.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", lpFilePart=0x0) returned 0x23 [0066.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llu2uku.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.491] GetFileType (hFile=0x354) returned 0x1 [0066.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.491] GetFileType (hFile=0x354) returned 0x1 [0066.491] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1572f [0066.492] ReadFile (in: hFile=0x354, lpBuffer=0x3f07e88, nNumberOfBytesToRead=0x1572f, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3f07e88*, lpNumberOfBytesRead=0xefece8*=0x1572f, lpOverlapped=0x0) returned 1 [0066.495] CloseHandle (hObject=0x354) returned 1 [0066.521] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", lpFilePart=0x0) returned 0x23 [0066.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.521] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llu2uku.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.522] GetFileType (hFile=0x354) returned 0x1 [0066.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.522] GetFileType (hFile=0x354) returned 0x1 [0066.522] WriteFile (in: hFile=0x354, lpBuffer=0x3f732b8*, nNumberOfBytesToWrite=0x15730, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3f732b8*, lpNumberOfBytesWritten=0xefecdc*=0x15730, lpOverlapped=0x0) returned 1 [0066.524] CloseHandle (hObject=0x354) returned 1 [0066.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav", lpFilePart=0x0) returned 0x23 [0066.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav.wholocked", lpFilePart=0x0) returned 0x2d [0066.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llu2uku.wav"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe049a470, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0xc44d9430, ftLastAccessTime.dwHighDateTime=0x1d5e648, ftLastWriteTime.dwLowDateTime=0x4917cf20, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x15730)) returned 1 [0066.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.576] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\llu2uku.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\llU2Uku.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\llu2uku.wav.wholocked")) returned 1 [0066.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", lpFilePart=0x0) returned 0x24 [0066.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mfwpl6bm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.577] GetFileType (hFile=0x354) returned 0x1 [0066.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.577] GetFileType (hFile=0x354) returned 0x1 [0066.577] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x17636 [0066.577] ReadFile (in: hFile=0x354, lpBuffer=0x3f88a08, nNumberOfBytesToRead=0x17636, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3f88a08*, lpNumberOfBytesRead=0xefece8*=0x17636, lpOverlapped=0x0) returned 1 [0066.579] CloseHandle (hObject=0x354) returned 1 [0066.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", lpFilePart=0x0) returned 0x24 [0066.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mfwpl6bm.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.607] GetFileType (hFile=0x354) returned 0x1 [0066.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.607] GetFileType (hFile=0x354) returned 0x1 [0066.607] WriteFile (in: hFile=0x354, lpBuffer=0x3ffd980*, nNumberOfBytesToWrite=0x17640, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3ffd980*, lpNumberOfBytesWritten=0xefecdc*=0x17640, lpOverlapped=0x0) returned 1 [0066.609] CloseHandle (hObject=0x354) returned 1 [0066.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a", lpFilePart=0x0) returned 0x24 [0066.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a.wholocked", lpFilePart=0x0) returned 0x2e [0066.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mfwpl6bm.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceebf90, ftCreationTime.dwHighDateTime=0x1d5e4e3, ftLastAccessTime.dwLowDateTime=0xa3890c20, ftLastAccessTime.dwHighDateTime=0x1d5ecd3, ftLastWriteTime.dwLowDateTime=0x491c95c5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17640)) returned 1 [0066.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.618] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mfwpl6bm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mFWpl6BM.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\mfwpl6bm.m4a.wholocked")) returned 1 [0066.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", lpFilePart=0x0) returned 0x20 [0066.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\mwqj.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.666] GetFileType (hFile=0x354) returned 0x1 [0066.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.666] GetFileType (hFile=0x354) returned 0x1 [0066.666] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x90f3 [0066.666] ReadFile (in: hFile=0x354, lpBuffer=0x2f691e8, nNumberOfBytesToRead=0x90f3, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f691e8*, lpNumberOfBytesRead=0xefece8*=0x90f3, lpOverlapped=0x0) returned 1 [0066.666] CloseHandle (hObject=0x354) returned 1 [0066.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", lpFilePart=0x0) returned 0x20 [0066.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\mwqj.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.687] GetFileType (hFile=0x354) returned 0x1 [0066.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.687] GetFileType (hFile=0x354) returned 0x1 [0066.687] WriteFile (in: hFile=0x354, lpBuffer=0x2fe34d4*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2fe34d4*, lpNumberOfBytesWritten=0xefecdc*=0x9100, lpOverlapped=0x0) returned 1 [0066.688] CloseHandle (hObject=0x354) returned 1 [0066.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf", lpFilePart=0x0) returned 0x20 [0066.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf.wholocked", lpFilePart=0x0) returned 0x2a [0066.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\mwqj.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18addda0, ftCreationTime.dwHighDateTime=0x1d5e7a7, ftLastAccessTime.dwLowDateTime=0x4b724b90, ftLastAccessTime.dwHighDateTime=0x1d5eb8f, ftLastWriteTime.dwLowDateTime=0x49287fc7, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x9100)) returned 1 [0066.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\mwqj.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mWqj.pdf.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\mwqj.pdf.wholocked")) returned 1 [0066.691] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", lpFilePart=0x0) returned 0x22 [0066.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.691] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ofv2br.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.691] GetFileType (hFile=0x354) returned 0x1 [0066.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.691] GetFileType (hFile=0x354) returned 0x1 [0066.691] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xb67d [0066.692] ReadFile (in: hFile=0x354, lpBuffer=0x2fec8b0, nNumberOfBytesToRead=0xb67d, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2fec8b0*, lpNumberOfBytesRead=0xefece8*=0xb67d, lpOverlapped=0x0) returned 1 [0066.692] CloseHandle (hObject=0x354) returned 1 [0066.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", lpFilePart=0x0) returned 0x22 [0066.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ofv2br.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.766] GetFileType (hFile=0x354) returned 0x1 [0066.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.766] GetFileType (hFile=0x354) returned 0x1 [0066.766] WriteFile (in: hFile=0x354, lpBuffer=0x305ba30*, nNumberOfBytesToWrite=0xb680, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x305ba30*, lpNumberOfBytesWritten=0xefecdc*=0xb680, lpOverlapped=0x0) returned 1 [0066.767] CloseHandle (hObject=0x354) returned 1 [0066.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a", lpFilePart=0x0) returned 0x22 [0066.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a.wholocked", lpFilePart=0x0) returned 0x2c [0066.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ofv2br.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3affaed0, ftCreationTime.dwHighDateTime=0x1d5ebc4, ftLastAccessTime.dwLowDateTime=0xc71188c0, ftLastAccessTime.dwHighDateTime=0x1d5eea4, ftLastWriteTime.dwLowDateTime=0x49346ad2, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xb680)) returned 1 [0066.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.770] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\ofv2br.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oFV2bR.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\ofv2br.m4a.wholocked")) returned 1 [0066.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", lpFilePart=0x0) returned 0x24 [0066.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\olqrlaap.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.770] GetFileType (hFile=0x354) returned 0x1 [0066.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.770] GetFileType (hFile=0x354) returned 0x1 [0066.771] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x15e6 [0066.771] ReadFile (in: hFile=0x354, lpBuffer=0x30673c0, nNumberOfBytesToRead=0x15e6, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x30673c0*, lpNumberOfBytesRead=0xefece8*=0x15e6, lpOverlapped=0x0) returned 1 [0066.771] CloseHandle (hObject=0x354) returned 1 [0066.792] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", lpFilePart=0x0) returned 0x24 [0066.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\olqrlaap.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.793] GetFileType (hFile=0x354) returned 0x1 [0066.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.793] GetFileType (hFile=0x354) returned 0x1 [0066.793] WriteFile (in: hFile=0x354, lpBuffer=0x30baf5c*, nNumberOfBytesToWrite=0x15f0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x30baf5c*, lpNumberOfBytesWritten=0xefecdc*=0x15f0, lpOverlapped=0x0) returned 1 [0066.794] CloseHandle (hObject=0x354) returned 1 [0066.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv", lpFilePart=0x0) returned 0x24 [0066.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv.wholocked", lpFilePart=0x0) returned 0x2e [0066.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\olqrlaap.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6cb0, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xdad57a10, ftLastAccessTime.dwHighDateTime=0x1d5e350, ftLastWriteTime.dwLowDateTime=0x49392f93, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x15f0)) returned 1 [0066.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.795] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\olqrlaap.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\olQrLaAp.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\olqrlaap.mkv.wholocked")) returned 1 [0066.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", lpFilePart=0x0) returned 0x2b [0066.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oys2bm2jzjzuwj5.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.796] GetFileType (hFile=0x354) returned 0x1 [0066.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.796] GetFileType (hFile=0x354) returned 0x1 [0066.796] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x73de [0066.796] ReadFile (in: hFile=0x354, lpBuffer=0x30bc870, nNumberOfBytesToRead=0x73de, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x30bc870*, lpNumberOfBytesRead=0xefece8*=0x73de, lpOverlapped=0x0) returned 1 [0066.797] CloseHandle (hObject=0x354) returned 1 [0066.877] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", lpFilePart=0x0) returned 0x2b [0066.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0066.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oys2bm2jzjzuwj5.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.878] GetFileType (hFile=0x354) returned 0x1 [0066.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0066.878] GetFileType (hFile=0x354) returned 0x1 [0066.878] WriteFile (in: hFile=0x354, lpBuffer=0x312d9bc*, nNumberOfBytesToWrite=0x73e0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x312d9bc*, lpNumberOfBytesWritten=0xefecdc*=0x73e0, lpOverlapped=0x0) returned 1 [0066.879] CloseHandle (hObject=0x354) returned 1 [0066.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a", lpFilePart=0x0) returned 0x2b [0066.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a.wholocked", lpFilePart=0x0) returned 0x35 [0066.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0066.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oys2bm2jzjzuwj5.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880623e0, ftCreationTime.dwHighDateTime=0x1d5e281, ftLastAccessTime.dwLowDateTime=0xeb833810, ftLastAccessTime.dwHighDateTime=0x1d5eb3f, ftLastWriteTime.dwLowDateTime=0x49451b86, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x73e0)) returned 1 [0066.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0066.881] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\oys2bm2jzjzuwj5.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oys2bm2JZJzuwj5.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\oys2bm2jzjzuwj5.m4a.wholocked")) returned 1 [0066.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", lpFilePart=0x0) returned 0x23 [0066.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0066.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\qg-y0hg.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0066.882] GetFileType (hFile=0x354) returned 0x1 [0066.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0066.882] GetFileType (hFile=0x354) returned 0x1 [0066.882] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xcf70 [0066.882] ReadFile (in: hFile=0x354, lpBuffer=0x31350dc, nNumberOfBytesToRead=0xcf70, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x31350dc*, lpNumberOfBytesRead=0xefece8*=0xcf70, lpOverlapped=0x0) returned 1 [0066.883] CloseHandle (hObject=0x354) returned 1 [0067.285] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", lpFilePart=0x0) returned 0x23 [0067.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.285] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\qg-y0hg.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.287] GetFileType (hFile=0x354) returned 0x1 [0067.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.287] GetFileType (hFile=0x354) returned 0x1 [0067.287] WriteFile (in: hFile=0x354, lpBuffer=0x2e047a4*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e047a4*, lpNumberOfBytesWritten=0xefecdc*=0xcf80, lpOverlapped=0x0) returned 1 [0067.289] CloseHandle (hObject=0x354) returned 1 [0067.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp", lpFilePart=0x0) returned 0x23 [0067.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp.wholocked", lpFilePart=0x0) returned 0x2d [0067.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\qg-y0hg.odp"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7934280, ftCreationTime.dwHighDateTime=0x1d5ee0d, ftLastAccessTime.dwLowDateTime=0x133ae950, ftLastAccessTime.dwHighDateTime=0x1d5ee2b, ftLastWriteTime.dwLowDateTime=0x49831a0f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xcf80)) returned 1 [0067.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp" (normalized: "c:\\users\\fd1hvy\\desktop\\qg-y0hg.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\QG-y0HG.odp.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\qg-y0hg.odp.wholocked")) returned 1 [0067.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", lpFilePart=0x0) returned 0x2b [0067.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\tr-c8vmx_kefwzm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.294] GetFileType (hFile=0x354) returned 0x1 [0067.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.294] GetFileType (hFile=0x354) returned 0x1 [0067.294] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x12fea [0067.295] ReadFile (in: hFile=0x354, lpBuffer=0x2e11a4c, nNumberOfBytesToRead=0x12fea, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e11a4c*, lpNumberOfBytesRead=0xefece8*=0x12fea, lpOverlapped=0x0) returned 1 [0067.295] CloseHandle (hObject=0x354) returned 1 [0067.378] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", lpFilePart=0x0) returned 0x2b [0067.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.378] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\tr-c8vmx_kefwzm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.379] GetFileType (hFile=0x354) returned 0x1 [0067.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.379] GetFileType (hFile=0x354) returned 0x1 [0067.379] WriteFile (in: hFile=0x354, lpBuffer=0x2e97978*, nNumberOfBytesToWrite=0x12ff0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e97978*, lpNumberOfBytesWritten=0xefecdc*=0x12ff0, lpOverlapped=0x0) returned 1 [0067.381] CloseHandle (hObject=0x354) returned 1 [0067.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg", lpFilePart=0x0) returned 0x2b [0067.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg.wholocked", lpFilePart=0x0) returned 0x35 [0067.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\tr-c8vmx_kefwzm.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa616e5a0, ftCreationTime.dwHighDateTime=0x1d5ee15, ftLastAccessTime.dwLowDateTime=0xbec2d40, ftLastAccessTime.dwHighDateTime=0x1d5f0d7, ftLastWriteTime.dwLowDateTime=0x4991bd5f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x12ff0)) returned 1 [0067.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.384] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\tr-c8vmx_kefwzm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\tr-c8vmX_KEfWZm.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\tr-c8vmx_kefwzm.jpg.wholocked")) returned 1 [0067.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", lpFilePart=0x0) returned 0x2b [0067.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.385] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ttsxtsgdujqas7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.385] GetFileType (hFile=0x354) returned 0x1 [0067.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.385] GetFileType (hFile=0x354) returned 0x1 [0067.385] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1057d [0067.385] ReadFile (in: hFile=0x354, lpBuffer=0x2eaacc8, nNumberOfBytesToRead=0x1057d, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2eaacc8*, lpNumberOfBytesRead=0xefece8*=0x1057d, lpOverlapped=0x0) returned 1 [0067.386] CloseHandle (hObject=0x354) returned 1 [0067.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", lpFilePart=0x0) returned 0x2b [0067.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ttsxtsgdujqas7.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.405] GetFileType (hFile=0x354) returned 0x1 [0067.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.405] GetFileType (hFile=0x354) returned 0x1 [0067.405] WriteFile (in: hFile=0x354, lpBuffer=0x2f28b48*, nNumberOfBytesToWrite=0x10580, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f28b48*, lpNumberOfBytesWritten=0xefecdc*=0x10580, lpOverlapped=0x0) returned 1 [0067.407] CloseHandle (hObject=0x354) returned 1 [0067.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx", lpFilePart=0x0) returned 0x2b [0067.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx.wholocked", lpFilePart=0x0) returned 0x35 [0067.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ttsxtsgdujqas7.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfccafc0, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x201998c0, ftLastAccessTime.dwHighDateTime=0x1d5e786, ftLastWriteTime.dwLowDateTime=0x49968415, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x10580)) returned 1 [0067.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.410] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\ttsxtsgdujqas7.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\TtSxTSGDujQAS7.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\ttsxtsgdujqas7.pptx.wholocked")) returned 1 [0067.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", lpFilePart=0x0) returned 0x25 [0067.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\u6typ6iy.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.410] GetFileType (hFile=0x354) returned 0x1 [0067.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.410] GetFileType (hFile=0x354) returned 0x1 [0067.411] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x17816 [0067.411] ReadFile (in: hFile=0x354, lpBuffer=0x408c6c0, nNumberOfBytesToRead=0x17816, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x408c6c0*, lpNumberOfBytesRead=0xefece8*=0x17816, lpOverlapped=0x0) returned 1 [0067.413] CloseHandle (hObject=0x354) returned 1 [0067.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", lpFilePart=0x0) returned 0x25 [0067.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\u6typ6iy.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.486] GetFileType (hFile=0x354) returned 0x1 [0067.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.486] GetFileType (hFile=0x354) returned 0x1 [0067.486] WriteFile (in: hFile=0x354, lpBuffer=0x3e0ff08*, nNumberOfBytesToWrite=0x17820, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3e0ff08*, lpNumberOfBytesWritten=0xefecdc*=0x17820, lpOverlapped=0x0) returned 1 [0067.488] CloseHandle (hObject=0x354) returned 1 [0067.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx", lpFilePart=0x0) returned 0x25 [0067.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx.wholocked", lpFilePart=0x0) returned 0x2f [0067.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\u6typ6iy.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4feedf0, ftCreationTime.dwHighDateTime=0x1d5e706, ftLastAccessTime.dwLowDateTime=0xb822a9d0, ftLastAccessTime.dwHighDateTime=0x1d5e278, ftLastWriteTime.dwLowDateTime=0x49a26e84, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17820)) returned 1 [0067.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.491] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\u6typ6iy.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\U6tyP6Iy.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\u6typ6iy.docx.wholocked")) returned 1 [0067.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", lpFilePart=0x0) returned 0x20 [0067.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vbwk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.492] GetFileType (hFile=0x354) returned 0x1 [0067.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.492] GetFileType (hFile=0x354) returned 0x1 [0067.492] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x6cd1 [0067.492] ReadFile (in: hFile=0x354, lpBuffer=0x2dcd6bc, nNumberOfBytesToRead=0x6cd1, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2dcd6bc*, lpNumberOfBytesRead=0xefece8*=0x6cd1, lpOverlapped=0x0) returned 1 [0067.492] CloseHandle (hObject=0x354) returned 1 [0067.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", lpFilePart=0x0) returned 0x20 [0067.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vbwk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.602] GetFileType (hFile=0x354) returned 0x1 [0067.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.602] GetFileType (hFile=0x354) returned 0x1 [0067.602] WriteFile (in: hFile=0x354, lpBuffer=0x2e3c664*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e3c664*, lpNumberOfBytesWritten=0xefecdc*=0x6ce0, lpOverlapped=0x0) returned 1 [0067.603] CloseHandle (hObject=0x354) returned 1 [0067.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vBWk.png", lpFilePart=0x0) returned 0x20 [0067.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vBWk.png.wholocked", lpFilePart=0x0) returned 0x2a [0067.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vbwk.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d83490, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x335d4080, ftLastAccessTime.dwHighDateTime=0x1d5ef4c, ftLastWriteTime.dwLowDateTime=0x49b323ee, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6ce0)) returned 1 [0067.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.605] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vbwk.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vBWk.png.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\vbwk.png.wholocked")) returned 1 [0067.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", lpFilePart=0x0) returned 0x2f [0067.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vr8jq2rmtxn04ojzsmw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.606] GetFileType (hFile=0x354) returned 0x1 [0067.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.606] GetFileType (hFile=0x354) returned 0x1 [0067.606] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x6cf9 [0067.606] ReadFile (in: hFile=0x354, lpBuffer=0x2e43650, nNumberOfBytesToRead=0x6cf9, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e43650*, lpNumberOfBytesRead=0xefece8*=0x6cf9, lpOverlapped=0x0) returned 1 [0067.606] CloseHandle (hObject=0x354) returned 1 [0067.702] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", lpFilePart=0x0) returned 0x2f [0067.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.703] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vr8jq2rmtxn04ojzsmw.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.704] GetFileType (hFile=0x354) returned 0x1 [0067.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.704] GetFileType (hFile=0x354) returned 0x1 [0067.704] WriteFile (in: hFile=0x354, lpBuffer=0x2eb253c*, nNumberOfBytesToWrite=0x6d00, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2eb253c*, lpNumberOfBytesWritten=0xefecdc*=0x6d00, lpOverlapped=0x0) returned 1 [0067.705] CloseHandle (hObject=0x354) returned 1 [0067.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg", lpFilePart=0x0) returned 0x2f [0067.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg.wholocked", lpFilePart=0x0) returned 0x39 [0067.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vr8jq2rmtxn04ojzsmw.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80780290, ftCreationTime.dwHighDateTime=0x1d5e756, ftLastAccessTime.dwLowDateTime=0xc6797cd0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0x49c3d21f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6d00)) returned 1 [0067.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.707] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vr8jq2rmtxn04ojzsmw.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vR8JQ2rMtXN04OJZSmW.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\vr8jq2rmtxn04ojzsmw.jpg.wholocked")) returned 1 [0067.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", lpFilePart=0x0) returned 0x29 [0067.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vu91-ro6yajrh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.708] GetFileType (hFile=0x354) returned 0x1 [0067.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.708] GetFileType (hFile=0x354) returned 0x1 [0067.708] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x6de7 [0067.708] ReadFile (in: hFile=0x354, lpBuffer=0x2eb95bc, nNumberOfBytesToRead=0x6de7, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2eb95bc*, lpNumberOfBytesRead=0xefece8*=0x6de7, lpOverlapped=0x0) returned 1 [0067.708] CloseHandle (hObject=0x354) returned 1 [0067.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", lpFilePart=0x0) returned 0x29 [0067.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vu91-ro6yajrh.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.725] GetFileType (hFile=0x354) returned 0x1 [0067.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0067.725] GetFileType (hFile=0x354) returned 0x1 [0067.725] WriteFile (in: hFile=0x354, lpBuffer=0x2f28958*, nNumberOfBytesToWrite=0x6df0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f28958*, lpNumberOfBytesWritten=0xefecdc*=0x6df0, lpOverlapped=0x0) returned 1 [0067.726] CloseHandle (hObject=0x354) returned 1 [0067.727] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png", lpFilePart=0x0) returned 0x29 [0067.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png.wholocked", lpFilePart=0x0) returned 0x33 [0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0067.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vu91-ro6yajrh.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146bdae0, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0x4155b180, ftLastAccessTime.dwHighDateTime=0x1d5e30e, ftLastWriteTime.dwLowDateTime=0x49c631fd, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6df0)) returned 1 [0067.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0067.728] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png" (normalized: "c:\\users\\fd1hvy\\desktop\\vu91-ro6yajrh.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vU91-Ro6yaJRH.png.wholocked" (normalized: "c:\\users\\fd1hvy\\desktop\\vu91-ro6yajrh.png.wholocked")) returned 1 [0067.728] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.728] GetFileType (hFile=0x354) returned 0x1 [0067.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.729] GetFileType (hFile=0x354) returned 0x1 [0067.729] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x31400 [0067.730] ReadFile (in: hFile=0x354, lpBuffer=0x3e27748, nNumberOfBytesToRead=0x31400, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3e27748*, lpNumberOfBytesRead=0xefece8*=0x31400, lpOverlapped=0x0) returned 1 [0067.731] CloseHandle (hObject=0x354) returned 1 [0067.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0067.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0067.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0067.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefcfd0) returned 1 [0067.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0067.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\", lpFilePart=0x0) returned 0x1a [0067.876] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd458 [0067.877] FindNextFileW (in: hFindFile=0x12cd458, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.877] FindNextFileW (in: hFindFile=0x12cd458, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.877] FindNextFileW (in: hFindFile=0x12cd458, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.877] FindClose (in: hFindFile=0x12cd458 | out: hFindFile=0x12cd458) returned 1 [0067.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0067.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0067.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0067.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\", lpFilePart=0x0) returned 0x1a [0067.878] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd418 [0067.878] FindNextFileW (in: hFindFile=0x12cd418, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.878] FindNextFileW (in: hFindFile=0x12cd418, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.878] FindNextFileW (in: hFindFile=0x12cd418, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0067.878] FindClose (in: hFindFile=0x12cd418 | out: hFindFile=0x12cd418) returned 1 [0067.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0067.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0067.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0067.878] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\", lpFilePart=0x0) returned 0x1a [0067.879] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5352fcc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5352fcc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd358 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5352fcc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5352fcc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5942620, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0xffc5cd40, ftLastAccessTime.dwHighDateTime=0x1d5c2b5, ftLastWriteTime.dwLowDateTime=0xffc5cd40, ftLastWriteTime.dwHighDateTime=0x1d5c2b5, nFileSizeHigh=0x0, nFileSizeLow=0x1d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1bovzmeYD.docx", cAlternateFileName="1BOVZM~1.DOC")) returned 1 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc137a440, ftCreationTime.dwHighDateTime=0x1d5cd73, ftLastAccessTime.dwLowDateTime=0xaf28d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e03e, ftLastWriteTime.dwLowDateTime=0xaf28d2a0, ftLastWriteTime.dwHighDateTime=0x1d5e03e, nFileSizeHigh=0x0, nFileSizeLow=0x2449, dwReserved0=0x0, dwReserved1=0x0, cFileName="20Tzn6JZ6Jj7Ez.docx", cAlternateFileName="20TZN6~1.DOC")) returned 1 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b30860, ftCreationTime.dwHighDateTime=0x1d5834a, ftLastAccessTime.dwLowDateTime=0xd3a7ff10, ftLastAccessTime.dwHighDateTime=0x1d5b25e, ftLastWriteTime.dwLowDateTime=0xd3a7ff10, ftLastWriteTime.dwHighDateTime=0x1d5b25e, nFileSizeHigh=0x0, nFileSizeLow=0x18f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="3D4MhdIH0.xlsx", cAlternateFileName="3D4MHD~1.XLS")) returned 1 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f06b90, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x51524590, ftLastAccessTime.dwHighDateTime=0x1d58b92, ftLastWriteTime.dwLowDateTime=0x51524590, ftLastWriteTime.dwHighDateTime=0x1d58b92, nFileSizeHigh=0x0, nFileSizeLow=0x4c52, dwReserved0=0x0, dwReserved1=0x0, cFileName="550aDv8 iuz4fpRjuxjb.pptx", cAlternateFileName="550ADV~1.PPT")) returned 1 [0067.879] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42580ff0, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x84007100, ftLastAccessTime.dwHighDateTime=0x1d57de2, ftLastWriteTime.dwLowDateTime=0x84007100, ftLastWriteTime.dwHighDateTime=0x1d57de2, nFileSizeHigh=0x0, nFileSizeLow=0x8785, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ZEbFnu2VdW3fzxL.docx", cAlternateFileName="8ZEBFN~1.DOC")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6132fff0, ftCreationTime.dwHighDateTime=0x1d5dc59, ftLastAccessTime.dwLowDateTime=0x49cc5b80, ftLastAccessTime.dwHighDateTime=0x1d568b0, ftLastWriteTime.dwLowDateTime=0x49cc5b80, ftLastWriteTime.dwHighDateTime=0x1d568b0, nFileSizeHigh=0x0, nFileSizeLow=0x13e77, dwReserved0=0x0, dwReserved1=0x0, cFileName="9OMRjt2LnbaINR.pptx", cAlternateFileName="9OMRJT~1.PPT")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12c8820, ftCreationTime.dwHighDateTime=0x1d591c6, ftLastAccessTime.dwLowDateTime=0x578f080, ftLastAccessTime.dwHighDateTime=0x1d5d27b, ftLastWriteTime.dwLowDateTime=0x578f080, ftLastWriteTime.dwHighDateTime=0x1d5d27b, nFileSizeHigh=0x0, nFileSizeLow=0x9026, dwReserved0=0x0, dwReserved1=0x0, cFileName="aCflyMvi.xlsx", cAlternateFileName="ACFLYM~1.XLS")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd847280, ftCreationTime.dwHighDateTime=0x1d5dde9, ftLastAccessTime.dwLowDateTime=0x54a7d640, ftLastAccessTime.dwHighDateTime=0x1d5aaac, ftLastWriteTime.dwLowDateTime=0x54a7d640, ftLastWriteTime.dwHighDateTime=0x1d5aaac, nFileSizeHigh=0x0, nFileSizeLow=0x5af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="aXrO8d7h8zaiF.pptx", cAlternateFileName="AXRO8D~1.PPT")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb670e770, ftCreationTime.dwHighDateTime=0x1d572b4, ftLastAccessTime.dwLowDateTime=0xf59320, ftLastAccessTime.dwHighDateTime=0x1d5858b, ftLastWriteTime.dwLowDateTime=0xf59320, ftLastWriteTime.dwHighDateTime=0x1d5858b, nFileSizeHigh=0x0, nFileSizeLow=0x140e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="A_ LH6ioC22MX7JMi.pptx", cAlternateFileName="A_LH6I~1.PPT")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b72c20, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x5d07aa50, ftLastAccessTime.dwHighDateTime=0x1d57af4, ftLastWriteTime.dwLowDateTime=0x5d07aa50, ftLastWriteTime.dwHighDateTime=0x1d57af4, nFileSizeHigh=0x0, nFileSizeLow=0x94db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehvnq.xlsx", cAlternateFileName="EHVNQ~1.XLS")) returned 1 [0067.880] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34885d60, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x3cbad210, ftLastAccessTime.dwHighDateTime=0x1d5e4ce, ftLastWriteTime.dwLowDateTime=0x3cbad210, ftLastWriteTime.dwHighDateTime=0x1d5e4ce, nFileSizeHigh=0x0, nFileSizeLow=0x74fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgSE4-YRMy20gn.odp", cAlternateFileName="FGSE4-~1.ODP")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2785ee80, ftCreationTime.dwHighDateTime=0x1d5db90, ftLastAccessTime.dwLowDateTime=0xe0211200, ftLastAccessTime.dwHighDateTime=0x1d5b8b6, ftLastWriteTime.dwLowDateTime=0xe0211200, ftLastWriteTime.dwHighDateTime=0x1d5b8b6, nFileSizeHigh=0x0, nFileSizeLow=0xf9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgJrXI_.docx", cAlternateFileName="HGJRXI~1.DOC")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3509b0, ftCreationTime.dwHighDateTime=0x1d5ed64, ftLastAccessTime.dwLowDateTime=0x5a7b5830, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0x5a7b5830, ftLastWriteTime.dwHighDateTime=0x1d5dbee, nFileSizeHigh=0x0, nFileSizeLow=0xfdb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJ0_2f8MrdJY0.pptx", cAlternateFileName="HJ0_2F~1.PPT")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffa61b0, ftCreationTime.dwHighDateTime=0x1d5ea50, ftLastAccessTime.dwLowDateTime=0x3503bc90, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x3503bc90, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0xba30, dwReserved0=0x0, dwReserved1=0x0, cFileName="i l3mX.pps", cAlternateFileName="IL3MX~1.PPS")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0067.881] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6009d0, ftCreationTime.dwHighDateTime=0x1d5e55c, ftLastAccessTime.dwLowDateTime=0xef211e40, ftLastAccessTime.dwHighDateTime=0x1d5f0f0, ftLastWriteTime.dwLowDateTime=0xef211e40, ftLastWriteTime.dwHighDateTime=0x1d5f0f0, nFileSizeHigh=0x0, nFileSizeLow=0x1794e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nRGTGAxtRXflmG_.pptx", cAlternateFileName="NRGTGA~1.PPT")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTj7fDIis5pb3Oa", cAlternateFileName="NTJ7FD~1")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0a48e0, ftCreationTime.dwHighDateTime=0x1d599d2, ftLastAccessTime.dwLowDateTime=0x35d096f0, ftLastAccessTime.dwHighDateTime=0x1d59cf9, ftLastWriteTime.dwLowDateTime=0x35d096f0, ftLastWriteTime.dwHighDateTime=0x1d59cf9, nFileSizeHigh=0x0, nFileSizeLow=0x31c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QxJYWGczqc3bo1wB.docx", cAlternateFileName="QXJYWG~1.DOC")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68d8860, ftCreationTime.dwHighDateTime=0x1d5e134, ftLastAccessTime.dwLowDateTime=0x7a16f300, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x7a16f300, ftLastWriteTime.dwHighDateTime=0x1d5f072, nFileSizeHigh=0x0, nFileSizeLow=0xf7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="rS67d--KDChewWhvv8.odp", cAlternateFileName="RS67D-~1.ODP")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956a3a80, ftCreationTime.dwHighDateTime=0x1d5691e, ftLastAccessTime.dwLowDateTime=0x270125e0, ftLastAccessTime.dwHighDateTime=0x1d590d8, ftLastWriteTime.dwLowDateTime=0x270125e0, ftLastWriteTime.dwHighDateTime=0x1d590d8, nFileSizeHigh=0x0, nFileSizeLow=0x9125, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0fY1QqrnrY5dp.xlsx", cAlternateFileName="T0FY1Q~1.XLS")) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd927be0, ftCreationTime.dwHighDateTime=0x1d5e910, ftLastAccessTime.dwLowDateTime=0x77c1d590, ftLastAccessTime.dwHighDateTime=0x1d5e0b2, ftLastWriteTime.dwLowDateTime=0x77c1d590, ftLastWriteTime.dwHighDateTime=0x1d5e0b2, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwtcBX.odt", cAlternateFileName="")) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25049530, ftCreationTime.dwHighDateTime=0x1d5e5e0, ftLastAccessTime.dwLowDateTime=0x40a1c7b0, ftLastAccessTime.dwHighDateTime=0x1d5ec0a, ftLastWriteTime.dwLowDateTime=0x40a1c7b0, ftLastWriteTime.dwHighDateTime=0x1d5ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x8f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsZmeeI4X.doc", cAlternateFileName="XSZMEE~1.DOC")) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fa7dd0, ftCreationTime.dwHighDateTime=0x1d5e222, ftLastAccessTime.dwLowDateTime=0x8d3eae40, ftLastAccessTime.dwHighDateTime=0x1d5cd0a, ftLastWriteTime.dwLowDateTime=0x8d3eae40, ftLastWriteTime.dwHighDateTime=0x1d5cd0a, nFileSizeHigh=0x0, nFileSizeLow=0xa822, dwReserved0=0x0, dwReserved1=0x0, cFileName="XyvM1gLVYRden8-.xlsx", cAlternateFileName="XYVM1G~1.XLS")) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x12cd358, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.883] FindClose (in: hFindFile=0x12cd358 | out: hFindFile=0x12cd358) returned 1 [0067.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0067.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0067.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0067.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\", lpFilePart=0x0) returned 0x1a [0067.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5352fcc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5352fcc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd398 [0067.883] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe5352fcc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe5352fcc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5942620, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0xffc5cd40, ftLastAccessTime.dwHighDateTime=0x1d5c2b5, ftLastWriteTime.dwLowDateTime=0xffc5cd40, ftLastWriteTime.dwHighDateTime=0x1d5c2b5, nFileSizeHigh=0x0, nFileSizeLow=0x1d4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1bovzmeYD.docx", cAlternateFileName="1BOVZM~1.DOC")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc137a440, ftCreationTime.dwHighDateTime=0x1d5cd73, ftLastAccessTime.dwLowDateTime=0xaf28d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e03e, ftLastWriteTime.dwLowDateTime=0xaf28d2a0, ftLastWriteTime.dwHighDateTime=0x1d5e03e, nFileSizeHigh=0x0, nFileSizeLow=0x2449, dwReserved0=0x0, dwReserved1=0x0, cFileName="20Tzn6JZ6Jj7Ez.docx", cAlternateFileName="20TZN6~1.DOC")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b30860, ftCreationTime.dwHighDateTime=0x1d5834a, ftLastAccessTime.dwLowDateTime=0xd3a7ff10, ftLastAccessTime.dwHighDateTime=0x1d5b25e, ftLastWriteTime.dwLowDateTime=0xd3a7ff10, ftLastWriteTime.dwHighDateTime=0x1d5b25e, nFileSizeHigh=0x0, nFileSizeLow=0x18f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="3D4MhdIH0.xlsx", cAlternateFileName="3D4MHD~1.XLS")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f06b90, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x51524590, ftLastAccessTime.dwHighDateTime=0x1d58b92, ftLastWriteTime.dwLowDateTime=0x51524590, ftLastWriteTime.dwHighDateTime=0x1d58b92, nFileSizeHigh=0x0, nFileSizeLow=0x4c52, dwReserved0=0x0, dwReserved1=0x0, cFileName="550aDv8 iuz4fpRjuxjb.pptx", cAlternateFileName="550ADV~1.PPT")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42580ff0, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x84007100, ftLastAccessTime.dwHighDateTime=0x1d57de2, ftLastWriteTime.dwLowDateTime=0x84007100, ftLastWriteTime.dwHighDateTime=0x1d57de2, nFileSizeHigh=0x0, nFileSizeLow=0x8785, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ZEbFnu2VdW3fzxL.docx", cAlternateFileName="8ZEBFN~1.DOC")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6132fff0, ftCreationTime.dwHighDateTime=0x1d5dc59, ftLastAccessTime.dwLowDateTime=0x49cc5b80, ftLastAccessTime.dwHighDateTime=0x1d568b0, ftLastWriteTime.dwLowDateTime=0x49cc5b80, ftLastWriteTime.dwHighDateTime=0x1d568b0, nFileSizeHigh=0x0, nFileSizeLow=0x13e77, dwReserved0=0x0, dwReserved1=0x0, cFileName="9OMRjt2LnbaINR.pptx", cAlternateFileName="9OMRJT~1.PPT")) returned 1 [0067.884] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12c8820, ftCreationTime.dwHighDateTime=0x1d591c6, ftLastAccessTime.dwLowDateTime=0x578f080, ftLastAccessTime.dwHighDateTime=0x1d5d27b, ftLastWriteTime.dwLowDateTime=0x578f080, ftLastWriteTime.dwHighDateTime=0x1d5d27b, nFileSizeHigh=0x0, nFileSizeLow=0x9026, dwReserved0=0x0, dwReserved1=0x0, cFileName="aCflyMvi.xlsx", cAlternateFileName="ACFLYM~1.XLS")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd847280, ftCreationTime.dwHighDateTime=0x1d5dde9, ftLastAccessTime.dwLowDateTime=0x54a7d640, ftLastAccessTime.dwHighDateTime=0x1d5aaac, ftLastWriteTime.dwLowDateTime=0x54a7d640, ftLastWriteTime.dwHighDateTime=0x1d5aaac, nFileSizeHigh=0x0, nFileSizeLow=0x5af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="aXrO8d7h8zaiF.pptx", cAlternateFileName="AXRO8D~1.PPT")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb670e770, ftCreationTime.dwHighDateTime=0x1d572b4, ftLastAccessTime.dwLowDateTime=0xf59320, ftLastAccessTime.dwHighDateTime=0x1d5858b, ftLastWriteTime.dwLowDateTime=0xf59320, ftLastWriteTime.dwHighDateTime=0x1d5858b, nFileSizeHigh=0x0, nFileSizeLow=0x140e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="A_ LH6ioC22MX7JMi.pptx", cAlternateFileName="A_LH6I~1.PPT")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b72c20, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x5d07aa50, ftLastAccessTime.dwHighDateTime=0x1d57af4, ftLastWriteTime.dwLowDateTime=0x5d07aa50, ftLastWriteTime.dwHighDateTime=0x1d57af4, nFileSizeHigh=0x0, nFileSizeLow=0x94db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ehvnq.xlsx", cAlternateFileName="EHVNQ~1.XLS")) returned 1 [0067.885] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34885d60, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x3cbad210, ftLastAccessTime.dwHighDateTime=0x1d5e4ce, ftLastWriteTime.dwLowDateTime=0x3cbad210, ftLastWriteTime.dwHighDateTime=0x1d5e4ce, nFileSizeHigh=0x0, nFileSizeLow=0x74fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgSE4-YRMy20gn.odp", cAlternateFileName="FGSE4-~1.ODP")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2785ee80, ftCreationTime.dwHighDateTime=0x1d5db90, ftLastAccessTime.dwLowDateTime=0xe0211200, ftLastAccessTime.dwHighDateTime=0x1d5b8b6, ftLastWriteTime.dwLowDateTime=0xe0211200, ftLastWriteTime.dwHighDateTime=0x1d5b8b6, nFileSizeHigh=0x0, nFileSizeLow=0xf9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgJrXI_.docx", cAlternateFileName="HGJRXI~1.DOC")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3509b0, ftCreationTime.dwHighDateTime=0x1d5ed64, ftLastAccessTime.dwLowDateTime=0x5a7b5830, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0x5a7b5830, ftLastWriteTime.dwHighDateTime=0x1d5dbee, nFileSizeHigh=0x0, nFileSizeLow=0xfdb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="hJ0_2f8MrdJY0.pptx", cAlternateFileName="HJ0_2F~1.PPT")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffa61b0, ftCreationTime.dwHighDateTime=0x1d5ea50, ftLastAccessTime.dwLowDateTime=0x3503bc90, ftLastAccessTime.dwHighDateTime=0x1d5e5e0, ftLastWriteTime.dwLowDateTime=0x3503bc90, ftLastWriteTime.dwHighDateTime=0x1d5e5e0, nFileSizeHigh=0x0, nFileSizeLow=0xba30, dwReserved0=0x0, dwReserved1=0x0, cFileName="i l3mX.pps", cAlternateFileName="IL3MX~1.PPS")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0067.886] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6009d0, ftCreationTime.dwHighDateTime=0x1d5e55c, ftLastAccessTime.dwLowDateTime=0xef211e40, ftLastAccessTime.dwHighDateTime=0x1d5f0f0, ftLastWriteTime.dwLowDateTime=0xef211e40, ftLastWriteTime.dwHighDateTime=0x1d5f0f0, nFileSizeHigh=0x0, nFileSizeLow=0x1794e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nRGTGAxtRXflmG_.pptx", cAlternateFileName="NRGTGA~1.PPT")) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTj7fDIis5pb3Oa", cAlternateFileName="NTJ7FD~1")) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0067.950] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0a48e0, ftCreationTime.dwHighDateTime=0x1d599d2, ftLastAccessTime.dwLowDateTime=0x35d096f0, ftLastAccessTime.dwHighDateTime=0x1d59cf9, ftLastWriteTime.dwLowDateTime=0x35d096f0, ftLastWriteTime.dwHighDateTime=0x1d59cf9, nFileSizeHigh=0x0, nFileSizeLow=0x31c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QxJYWGczqc3bo1wB.docx", cAlternateFileName="QXJYWG~1.DOC")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68d8860, ftCreationTime.dwHighDateTime=0x1d5e134, ftLastAccessTime.dwLowDateTime=0x7a16f300, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x7a16f300, ftLastWriteTime.dwHighDateTime=0x1d5f072, nFileSizeHigh=0x0, nFileSizeLow=0xf7ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="rS67d--KDChewWhvv8.odp", cAlternateFileName="RS67D-~1.ODP")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956a3a80, ftCreationTime.dwHighDateTime=0x1d5691e, ftLastAccessTime.dwLowDateTime=0x270125e0, ftLastAccessTime.dwHighDateTime=0x1d590d8, ftLastWriteTime.dwLowDateTime=0x270125e0, ftLastWriteTime.dwHighDateTime=0x1d590d8, nFileSizeHigh=0x0, nFileSizeLow=0x9125, dwReserved0=0x0, dwReserved1=0x0, cFileName="t0fY1QqrnrY5dp.xlsx", cAlternateFileName="T0FY1Q~1.XLS")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd927be0, ftCreationTime.dwHighDateTime=0x1d5e910, ftLastAccessTime.dwLowDateTime=0x77c1d590, ftLastAccessTime.dwHighDateTime=0x1d5e0b2, ftLastWriteTime.dwLowDateTime=0x77c1d590, ftLastWriteTime.dwHighDateTime=0x1d5e0b2, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="TwtcBX.odt", cAlternateFileName="")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25049530, ftCreationTime.dwHighDateTime=0x1d5e5e0, ftLastAccessTime.dwLowDateTime=0x40a1c7b0, ftLastAccessTime.dwHighDateTime=0x1d5ec0a, ftLastWriteTime.dwLowDateTime=0x40a1c7b0, ftLastWriteTime.dwHighDateTime=0x1d5ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x8f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsZmeeI4X.doc", cAlternateFileName="XSZMEE~1.DOC")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fa7dd0, ftCreationTime.dwHighDateTime=0x1d5e222, ftLastAccessTime.dwLowDateTime=0x8d3eae40, ftLastAccessTime.dwHighDateTime=0x1d5cd0a, ftLastWriteTime.dwLowDateTime=0x8d3eae40, ftLastWriteTime.dwHighDateTime=0x1d5cd0a, nFileSizeHigh=0x0, nFileSizeLow=0xa822, dwReserved0=0x0, dwReserved1=0x0, cFileName="XyvM1gLVYRden8-.xlsx", cAlternateFileName="XYVM1G~1.XLS")) returned 1 [0067.951] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fa7dd0, ftCreationTime.dwHighDateTime=0x1d5e222, ftLastAccessTime.dwLowDateTime=0x8d3eae40, ftLastAccessTime.dwHighDateTime=0x1d5cd0a, ftLastWriteTime.dwLowDateTime=0x8d3eae40, ftLastWriteTime.dwHighDateTime=0x1d5cd0a, nFileSizeHigh=0x0, nFileSizeLow=0xa822, dwReserved0=0x0, dwReserved1=0x0, cFileName="XyvM1gLVYRden8-.xlsx", cAlternateFileName="XYVM1G~1.XLS")) returned 0 [0067.952] FindClose (in: hFindFile=0x12cd398 | out: hFindFile=0x12cd398) returned 1 [0067.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0067.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0067.952] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", lpFilePart=0x0) returned 0x28 [0067.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0067.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1bovzmeyd.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0067.952] GetFileType (hFile=0x354) returned 0x1 [0067.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0067.952] GetFileType (hFile=0x354) returned 0x1 [0067.952] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1d4e [0067.952] ReadFile (in: hFile=0x354, lpBuffer=0x2f84d64, nNumberOfBytesToRead=0x1d4e, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f84d64*, lpNumberOfBytesRead=0xefece8*=0x1d4e, lpOverlapped=0x0) returned 1 [0067.952] CloseHandle (hObject=0x354) returned 1 [0068.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", lpFilePart=0x0) returned 0x28 [0068.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.047] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1bovzmeyd.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.048] GetFileType (hFile=0x354) returned 0x1 [0068.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.048] GetFileType (hFile=0x354) returned 0x1 [0068.048] WriteFile (in: hFile=0x354, lpBuffer=0x2ddeb70*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ddeb70*, lpNumberOfBytesWritten=0xefecdc*=0x1d50, lpOverlapped=0x0) returned 1 [0068.049] CloseHandle (hObject=0x354) returned 1 [0068.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx", lpFilePart=0x0) returned 0x28 [0068.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx.wholocked", lpFilePart=0x0) returned 0x32 [0068.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1bovzmeyd.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5942620, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0xffc5cd40, ftLastAccessTime.dwHighDateTime=0x1d5c2b5, ftLastWriteTime.dwLowDateTime=0x49f84547, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x1d50)) returned 1 [0068.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.050] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\1bovzmeyd.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\1bovzmeYD.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\1bovzmeyd.docx.wholocked")) returned 1 [0068.051] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", lpFilePart=0x0) returned 0x2d [0068.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.051] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx" (normalized: "c:\\users\\fd1hvy\\documents\\20tzn6jz6jj7ez.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.051] GetFileType (hFile=0x354) returned 0x1 [0068.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.051] GetFileType (hFile=0x354) returned 0x1 [0068.051] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x2449 [0068.051] ReadFile (in: hFile=0x354, lpBuffer=0x2de0c0c, nNumberOfBytesToRead=0x2449, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2de0c0c*, lpNumberOfBytesRead=0xefece8*=0x2449, lpOverlapped=0x0) returned 1 [0068.052] CloseHandle (hObject=0x354) returned 1 [0068.287] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", lpFilePart=0x0) returned 0x2d [0068.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx" (normalized: "c:\\users\\fd1hvy\\documents\\20tzn6jz6jj7ez.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.288] GetFileType (hFile=0x354) returned 0x1 [0068.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.288] GetFileType (hFile=0x354) returned 0x1 [0068.288] WriteFile (in: hFile=0x354, lpBuffer=0x2e390e4*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e390e4*, lpNumberOfBytesWritten=0xefecdc*=0x2450, lpOverlapped=0x0) returned 1 [0068.289] CloseHandle (hObject=0x354) returned 1 [0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx", lpFilePart=0x0) returned 0x2d [0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx.wholocked", lpFilePart=0x0) returned 0x37 [0068.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx" (normalized: "c:\\users\\fd1hvy\\documents\\20tzn6jz6jj7ez.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc137a440, ftCreationTime.dwHighDateTime=0x1d5cd73, ftLastAccessTime.dwLowDateTime=0xaf28d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e03e, ftLastWriteTime.dwLowDateTime=0x4a1c0898, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x2450)) returned 1 [0068.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.290] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx" (normalized: "c:\\users\\fd1hvy\\documents\\20tzn6jz6jj7ez.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\20Tzn6JZ6Jj7Ez.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\20tzn6jz6jj7ez.docx.wholocked")) returned 1 [0068.291] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", lpFilePart=0x0) returned 0x28 [0068.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\3d4mhdih0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.291] GetFileType (hFile=0x354) returned 0x1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.291] GetFileType (hFile=0x354) returned 0x1 [0068.291] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x18f99 [0068.292] ReadFile (in: hFile=0x354, lpBuffer=0x3f4eff8, nNumberOfBytesToRead=0x18f99, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3f4eff8*, lpNumberOfBytesRead=0xefece8*=0x18f99, lpOverlapped=0x0) returned 1 [0068.293] CloseHandle (hObject=0x354) returned 1 [0068.313] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", lpFilePart=0x0) returned 0x28 [0068.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.313] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\3d4mhdih0.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.314] GetFileType (hFile=0x354) returned 0x1 [0068.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.314] GetFileType (hFile=0x354) returned 0x1 [0068.314] WriteFile (in: hFile=0x354, lpBuffer=0x3fcbe50*, nNumberOfBytesToWrite=0x18fa0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3fcbe50*, lpNumberOfBytesWritten=0xefecdc*=0x18fa0, lpOverlapped=0x0) returned 1 [0068.316] CloseHandle (hObject=0x354) returned 1 [0068.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx", lpFilePart=0x0) returned 0x28 [0068.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx.wholocked", lpFilePart=0x0) returned 0x32 [0068.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\3d4mhdih0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b30860, ftCreationTime.dwHighDateTime=0x1d5834a, ftLastAccessTime.dwLowDateTime=0xd3a7ff10, ftLastAccessTime.dwHighDateTime=0x1d5b25e, ftLastWriteTime.dwLowDateTime=0x4a20cda2, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x18fa0)) returned 1 [0068.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.319] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\3d4mhdih0.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\3D4MhdIH0.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\3d4mhdih0.xlsx.wholocked")) returned 1 [0068.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", lpFilePart=0x0) returned 0x33 [0068.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\550adv8 iuz4fprjuxjb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.320] GetFileType (hFile=0x354) returned 0x1 [0068.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.320] GetFileType (hFile=0x354) returned 0x1 [0068.320] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x4c52 [0068.320] ReadFile (in: hFile=0x354, lpBuffer=0x2e889f0, nNumberOfBytesToRead=0x4c52, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e889f0*, lpNumberOfBytesRead=0xefece8*=0x4c52, lpOverlapped=0x0) returned 1 [0068.321] CloseHandle (hObject=0x354) returned 1 [0068.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", lpFilePart=0x0) returned 0x33 [0068.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.416] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\550adv8 iuz4fprjuxjb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.417] GetFileType (hFile=0x354) returned 0x1 [0068.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.417] GetFileType (hFile=0x354) returned 0x1 [0068.417] WriteFile (in: hFile=0x354, lpBuffer=0x2eed5bc*, nNumberOfBytesToWrite=0x4c60, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2eed5bc*, lpNumberOfBytesWritten=0xefecdc*=0x4c60, lpOverlapped=0x0) returned 1 [0068.418] CloseHandle (hObject=0x354) returned 1 [0068.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx", lpFilePart=0x0) returned 0x33 [0068.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx.wholocked", lpFilePart=0x0) returned 0x3d [0068.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\550adv8 iuz4fprjuxjb.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f06b90, ftCreationTime.dwHighDateTime=0x1d5bf54, ftLastAccessTime.dwLowDateTime=0x51524590, ftLastAccessTime.dwHighDateTime=0x1d58b92, ftLastWriteTime.dwLowDateTime=0x4a317deb, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x4c60)) returned 1 [0068.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.420] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\550adv8 iuz4fprjuxjb.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\550aDv8 iuz4fpRjuxjb.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\550adv8 iuz4fprjuxjb.pptx.wholocked")) returned 1 [0068.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", lpFilePart=0x0) returned 0x2f [0068.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.420] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8zebfnu2vdw3fzxl.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.420] GetFileType (hFile=0x354) returned 0x1 [0068.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.421] GetFileType (hFile=0x354) returned 0x1 [0068.421] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x8785 [0068.421] ReadFile (in: hFile=0x354, lpBuffer=0x2ef25d4, nNumberOfBytesToRead=0x8785, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ef25d4*, lpNumberOfBytesRead=0xefece8*=0x8785, lpOverlapped=0x0) returned 1 [0068.421] CloseHandle (hObject=0x354) returned 1 [0068.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", lpFilePart=0x0) returned 0x2f [0068.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8zebfnu2vdw3fzxl.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.486] GetFileType (hFile=0x354) returned 0x1 [0068.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.486] GetFileType (hFile=0x354) returned 0x1 [0068.486] WriteFile (in: hFile=0x354, lpBuffer=0x2f69990*, nNumberOfBytesToWrite=0x8790, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f69990*, lpNumberOfBytesWritten=0xefecdc*=0x8790, lpOverlapped=0x0) returned 1 [0068.487] CloseHandle (hObject=0x354) returned 1 [0068.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx", lpFilePart=0x0) returned 0x2f [0068.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx.wholocked", lpFilePart=0x0) returned 0x39 [0068.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8zebfnu2vdw3fzxl.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42580ff0, ftCreationTime.dwHighDateTime=0x1d5d892, ftLastAccessTime.dwLowDateTime=0x84007100, ftLastAccessTime.dwHighDateTime=0x1d57de2, ftLastWriteTime.dwLowDateTime=0x4a3b4874, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8790)) returned 1 [0068.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.489] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8zebfnu2vdw3fzxl.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\8ZEbFnu2VdW3fzxL.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\8zebfnu2vdw3fzxl.docx.wholocked")) returned 1 [0068.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", lpFilePart=0x0) returned 0x2d [0068.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9omrjt2lnbainr.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.489] GetFileType (hFile=0x354) returned 0x1 [0068.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.490] GetFileType (hFile=0x354) returned 0x1 [0068.490] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x13e77 [0068.490] ReadFile (in: hFile=0x354, lpBuffer=0x2f724a8, nNumberOfBytesToRead=0x13e77, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f724a8*, lpNumberOfBytesRead=0xefece8*=0x13e77, lpOverlapped=0x0) returned 1 [0068.490] CloseHandle (hObject=0x354) returned 1 [0068.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", lpFilePart=0x0) returned 0x2d [0068.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.510] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9omrjt2lnbainr.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.511] GetFileType (hFile=0x354) returned 0x1 [0068.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.511] GetFileType (hFile=0x354) returned 0x1 [0068.512] WriteFile (in: hFile=0x354, lpBuffer=0x2e12dfc*, nNumberOfBytesToWrite=0x13e80, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e12dfc*, lpNumberOfBytesWritten=0xefecdc*=0x13e80, lpOverlapped=0x0) returned 1 [0068.513] CloseHandle (hObject=0x354) returned 1 [0068.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx", lpFilePart=0x0) returned 0x2d [0068.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx.wholocked", lpFilePart=0x0) returned 0x37 [0068.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9omrjt2lnbainr.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6132fff0, ftCreationTime.dwHighDateTime=0x1d5dc59, ftLastAccessTime.dwLowDateTime=0x49cc5b80, ftLastAccessTime.dwHighDateTime=0x1d568b0, ftLastWriteTime.dwLowDateTime=0x4a3fcbb4, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x13e80)) returned 1 [0068.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.516] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9omrjt2lnbainr.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9OMRjt2LnbaINR.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\9omrjt2lnbainr.pptx.wholocked")) returned 1 [0068.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", lpFilePart=0x0) returned 0x27 [0068.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.517] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\acflymvi.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.517] GetFileType (hFile=0x354) returned 0x1 [0068.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.517] GetFileType (hFile=0x354) returned 0x1 [0068.517] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x9026 [0068.517] ReadFile (in: hFile=0x354, lpBuffer=0x2e26fd8, nNumberOfBytesToRead=0x9026, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e26fd8*, lpNumberOfBytesRead=0xefece8*=0x9026, lpOverlapped=0x0) returned 1 [0068.517] CloseHandle (hObject=0x354) returned 1 [0068.597] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", lpFilePart=0x0) returned 0x27 [0068.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\acflymvi.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.599] GetFileType (hFile=0x354) returned 0x1 [0068.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.599] GetFileType (hFile=0x354) returned 0x1 [0068.599] WriteFile (in: hFile=0x354, lpBuffer=0x2ea1010*, nNumberOfBytesToWrite=0x9030, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ea1010*, lpNumberOfBytesWritten=0xefecdc*=0x9030, lpOverlapped=0x0) returned 1 [0068.600] CloseHandle (hObject=0x354) returned 1 [0068.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx", lpFilePart=0x0) returned 0x27 [0068.602] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx.wholocked", lpFilePart=0x0) returned 0x31 [0068.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\acflymvi.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12c8820, ftCreationTime.dwHighDateTime=0x1d591c6, ftLastAccessTime.dwLowDateTime=0x578f080, ftLastAccessTime.dwHighDateTime=0x1d5d27b, ftLastWriteTime.dwLowDateTime=0x4a4bb74c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x9030)) returned 1 [0068.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.602] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\acflymvi.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aCflyMvi.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\acflymvi.xlsx.wholocked")) returned 1 [0068.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", lpFilePart=0x0) returned 0x2c [0068.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\axro8d7h8zaif.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.603] GetFileType (hFile=0x354) returned 0x1 [0068.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.603] GetFileType (hFile=0x354) returned 0x1 [0068.603] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x5af9 [0068.603] ReadFile (in: hFile=0x354, lpBuffer=0x2eaa378, nNumberOfBytesToRead=0x5af9, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2eaa378*, lpNumberOfBytesRead=0xefece8*=0x5af9, lpOverlapped=0x0) returned 1 [0068.604] CloseHandle (hObject=0x354) returned 1 [0068.621] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", lpFilePart=0x0) returned 0x2c [0068.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\axro8d7h8zaif.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.622] GetFileType (hFile=0x354) returned 0x1 [0068.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.622] GetFileType (hFile=0x354) returned 0x1 [0068.622] WriteFile (in: hFile=0x354, lpBuffer=0x2f13864*, nNumberOfBytesToWrite=0x5b00, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f13864*, lpNumberOfBytesWritten=0xefecdc*=0x5b00, lpOverlapped=0x0) returned 1 [0068.623] CloseHandle (hObject=0x354) returned 1 [0068.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx", lpFilePart=0x0) returned 0x2c [0068.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx.wholocked", lpFilePart=0x0) returned 0x36 [0068.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\axro8d7h8zaif.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd847280, ftCreationTime.dwHighDateTime=0x1d5dde9, ftLastAccessTime.dwLowDateTime=0x54a7d640, ftLastAccessTime.dwHighDateTime=0x1d5aaac, ftLastWriteTime.dwLowDateTime=0x4a507c46, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x5b00)) returned 1 [0068.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.624] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\axro8d7h8zaif.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aXrO8d7h8zaiF.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\axro8d7h8zaif.pptx.wholocked")) returned 1 [0068.625] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", lpFilePart=0x0) returned 0x30 [0068.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a_ lh6ioc22mx7jmi.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.625] GetFileType (hFile=0x354) returned 0x1 [0068.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.625] GetFileType (hFile=0x354) returned 0x1 [0068.625] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x140e8 [0068.625] ReadFile (in: hFile=0x354, lpBuffer=0x2f196e8, nNumberOfBytesToRead=0x140e8, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f196e8*, lpNumberOfBytesRead=0xefece8*=0x140e8, lpOverlapped=0x0) returned 1 [0068.626] CloseHandle (hObject=0x354) returned 1 [0068.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", lpFilePart=0x0) returned 0x30 [0068.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a_ lh6ioc22mx7jmi.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.694] GetFileType (hFile=0x354) returned 0x1 [0068.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.694] GetFileType (hFile=0x354) returned 0x1 [0068.694] WriteFile (in: hFile=0x354, lpBuffer=0x2fa27b4*, nNumberOfBytesToWrite=0x140f0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2fa27b4*, lpNumberOfBytesWritten=0xefecdc*=0x140f0, lpOverlapped=0x0) returned 1 [0068.696] CloseHandle (hObject=0x354) returned 1 [0068.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx", lpFilePart=0x0) returned 0x30 [0068.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx.wholocked", lpFilePart=0x0) returned 0x3a [0068.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a_ lh6ioc22mx7jmi.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb670e770, ftCreationTime.dwHighDateTime=0x1d572b4, ftLastAccessTime.dwLowDateTime=0xf59320, ftLastAccessTime.dwHighDateTime=0x1d5858b, ftLastWriteTime.dwLowDateTime=0x4a5a0525, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x140f0)) returned 1 [0068.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\a_ lh6ioc22mx7jmi.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\A_ LH6ioC22MX7JMi.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\a_ lh6ioc22mx7jmi.pptx.wholocked")) returned 1 [0068.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0068.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.703] GetFileType (hFile=0x354) returned 0x1 [0068.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.703] GetFileType (hFile=0x354) returned 0x1 [0068.703] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x55000 [0068.705] ReadFile (in: hFile=0x354, lpBuffer=0x4034cf0, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x4034cf0*, lpNumberOfBytesRead=0xefece8*=0x55000, lpOverlapped=0x0) returned 1 [0068.709] CloseHandle (hObject=0x354) returned 1 [0068.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0068.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.792] GetFileType (hFile=0x354) returned 0x1 [0068.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.792] GetFileType (hFile=0x354) returned 0x1 [0068.792] WriteFile (in: hFile=0x354, lpBuffer=0x3eb0ea8*, nNumberOfBytesToWrite=0x55010, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3eb0ea8*, lpNumberOfBytesWritten=0xefecdc*=0x55010, lpOverlapped=0x0) returned 1 [0068.799] CloseHandle (hObject=0x354) returned 1 [0068.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x29 [0068.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.wholocked", lpFilePart=0x0) returned 0x33 [0068.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x4a6ab5a5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x55010)) returned 1 [0068.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.807] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.wholocked")) returned 1 [0068.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", lpFilePart=0x0) returned 0x24 [0068.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ehvnq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.846] GetFileType (hFile=0x354) returned 0x1 [0068.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.846] GetFileType (hFile=0x354) returned 0x1 [0068.846] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x94db [0068.846] ReadFile (in: hFile=0x354, lpBuffer=0x2dcdedc, nNumberOfBytesToRead=0x94db, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2dcdedc*, lpNumberOfBytesRead=0xefece8*=0x94db, lpOverlapped=0x0) returned 1 [0068.846] CloseHandle (hObject=0x354) returned 1 [0068.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", lpFilePart=0x0) returned 0x24 [0068.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ehvnq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.952] GetFileType (hFile=0x354) returned 0x1 [0068.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.952] GetFileType (hFile=0x354) returned 0x1 [0068.952] WriteFile (in: hFile=0x354, lpBuffer=0x2e49684*, nNumberOfBytesToWrite=0x94e0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e49684*, lpNumberOfBytesWritten=0xefecdc*=0x94e0, lpOverlapped=0x0) returned 1 [0068.953] CloseHandle (hObject=0x354) returned 1 [0068.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx", lpFilePart=0x0) returned 0x24 [0068.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx.wholocked", lpFilePart=0x0) returned 0x2e [0068.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ehvnq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b72c20, ftCreationTime.dwHighDateTime=0x1d5b650, ftLastAccessTime.dwLowDateTime=0x5d07aa50, ftLastAccessTime.dwHighDateTime=0x1d57af4, ftLastWriteTime.dwLowDateTime=0x4a828d5d, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x94e0)) returned 1 [0068.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.955] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ehvnq.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ehvnq.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ehvnq.xlsx.wholocked")) returned 1 [0068.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", lpFilePart=0x0) returned 0x2c [0068.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.956] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp" (normalized: "c:\\users\\fd1hvy\\documents\\fgse4-yrmy20gn.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.956] GetFileType (hFile=0x354) returned 0x1 [0068.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.956] GetFileType (hFile=0x354) returned 0x1 [0068.956] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x74fb [0068.956] ReadFile (in: hFile=0x354, lpBuffer=0x2e52e88, nNumberOfBytesToRead=0x74fb, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e52e88*, lpNumberOfBytesRead=0xefece8*=0x74fb, lpOverlapped=0x0) returned 1 [0068.957] CloseHandle (hObject=0x354) returned 1 [0068.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", lpFilePart=0x0) returned 0x2c [0068.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0068.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp" (normalized: "c:\\users\\fd1hvy\\documents\\fgse4-yrmy20gn.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.973] GetFileType (hFile=0x354) returned 0x1 [0068.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0068.973] GetFileType (hFile=0x354) returned 0x1 [0068.973] WriteFile (in: hFile=0x354, lpBuffer=0x2ec4574*, nNumberOfBytesToWrite=0x7500, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ec4574*, lpNumberOfBytesWritten=0xefecdc*=0x7500, lpOverlapped=0x0) returned 1 [0068.975] CloseHandle (hObject=0x354) returned 1 [0068.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp", lpFilePart=0x0) returned 0x2c [0068.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp.wholocked", lpFilePart=0x0) returned 0x36 [0068.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0068.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp" (normalized: "c:\\users\\fd1hvy\\documents\\fgse4-yrmy20gn.odp"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34885d60, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x3cbad210, ftLastAccessTime.dwHighDateTime=0x1d5e4ce, ftLastWriteTime.dwLowDateTime=0x4a84ee16, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x7500)) returned 1 [0068.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0068.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp" (normalized: "c:\\users\\fd1hvy\\documents\\fgse4-yrmy20gn.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\FgSE4-YRMy20gn.odp.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\fgse4-yrmy20gn.odp.wholocked")) returned 1 [0068.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", lpFilePart=0x0) returned 0x26 [0068.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0068.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hgjrxi_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0068.977] GetFileType (hFile=0x354) returned 0x1 [0068.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0068.977] GetFileType (hFile=0x354) returned 0x1 [0068.977] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xf9e2 [0068.977] ReadFile (in: hFile=0x354, lpBuffer=0x2ecbdd0, nNumberOfBytesToRead=0xf9e2, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ecbdd0*, lpNumberOfBytesRead=0xefece8*=0xf9e2, lpOverlapped=0x0) returned 1 [0068.977] CloseHandle (hObject=0x354) returned 1 [0069.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", lpFilePart=0x0) returned 0x26 [0069.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hgjrxi_.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.076] GetFileType (hFile=0x354) returned 0x1 [0069.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.076] GetFileType (hFile=0x354) returned 0x1 [0069.076] WriteFile (in: hFile=0x354, lpBuffer=0x2f479a0*, nNumberOfBytesToWrite=0xf9f0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f479a0*, lpNumberOfBytesWritten=0xefecdc*=0xf9f0, lpOverlapped=0x0) returned 1 [0069.078] CloseHandle (hObject=0x354) returned 1 [0069.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx", lpFilePart=0x0) returned 0x26 [0069.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx.wholocked", lpFilePart=0x0) returned 0x30 [0069.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hgjrxi_.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2785ee80, ftCreationTime.dwHighDateTime=0x1d5db90, ftLastAccessTime.dwLowDateTime=0xe0211200, ftLastAccessTime.dwHighDateTime=0x1d5b8b6, ftLastWriteTime.dwLowDateTime=0x4a959fb1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xf9f0)) returned 1 [0069.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx" (normalized: "c:\\users\\fd1hvy\\documents\\hgjrxi_.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hgJrXI_.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\hgjrxi_.docx.wholocked")) returned 1 [0069.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", lpFilePart=0x0) returned 0x2c [0069.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hj0_2f8mrdjy0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.081] GetFileType (hFile=0x354) returned 0x1 [0069.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.081] GetFileType (hFile=0x354) returned 0x1 [0069.081] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xfdb3 [0069.081] ReadFile (in: hFile=0x354, lpBuffer=0x2f576c8, nNumberOfBytesToRead=0xfdb3, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f576c8*, lpNumberOfBytesRead=0xefece8*=0xfdb3, lpOverlapped=0x0) returned 1 [0069.081] CloseHandle (hObject=0x354) returned 1 [0069.250] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", lpFilePart=0x0) returned 0x2c [0069.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.250] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hj0_2f8mrdjy0.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.251] GetFileType (hFile=0x354) returned 0x1 [0069.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.251] GetFileType (hFile=0x354) returned 0x1 [0069.252] WriteFile (in: hFile=0x354, lpBuffer=0x2dde298*, nNumberOfBytesToWrite=0xfdc0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2dde298*, lpNumberOfBytesWritten=0xefecdc*=0xfdc0, lpOverlapped=0x0) returned 1 [0069.253] CloseHandle (hObject=0x354) returned 1 [0069.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx", lpFilePart=0x0) returned 0x2c [0069.255] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx.wholocked", lpFilePart=0x0) returned 0x36 [0069.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.255] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hj0_2f8mrdjy0.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3509b0, ftCreationTime.dwHighDateTime=0x1d5ed64, ftLastAccessTime.dwLowDateTime=0x5a7b5830, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0x4aafd9b4, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xfdc0)) returned 1 [0069.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.255] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\hj0_2f8mrdjy0.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\hJ0_2f8MrdJY0.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\hj0_2f8mrdjy0.pptx.wholocked")) returned 1 [0069.256] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", lpFilePart=0x0) returned 0x2e [0069.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\nrgtgaxtrxflmg_.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.256] GetFileType (hFile=0x354) returned 0x1 [0069.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.256] GetFileType (hFile=0x354) returned 0x1 [0069.256] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1794e [0069.257] ReadFile (in: hFile=0x354, lpBuffer=0x4089d10, nNumberOfBytesToRead=0x1794e, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x4089d10*, lpNumberOfBytesRead=0xefece8*=0x1794e, lpOverlapped=0x0) returned 1 [0069.257] CloseHandle (hObject=0x354) returned 1 [0069.460] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", lpFilePart=0x0) returned 0x2e [0069.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\nrgtgaxtrxflmg_.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.461] GetFileType (hFile=0x354) returned 0x1 [0069.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.462] GetFileType (hFile=0x354) returned 0x1 [0069.462] WriteFile (in: hFile=0x354, lpBuffer=0x3fa3398*, nNumberOfBytesToWrite=0x17950, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3fa3398*, lpNumberOfBytesWritten=0xefecdc*=0x17950, lpOverlapped=0x0) returned 1 [0069.464] CloseHandle (hObject=0x354) returned 1 [0069.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx", lpFilePart=0x0) returned 0x2e [0069.474] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx.wholocked", lpFilePart=0x0) returned 0x38 [0069.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\nrgtgaxtrxflmg_.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f6009d0, ftCreationTime.dwHighDateTime=0x1d5e55c, ftLastAccessTime.dwLowDateTime=0xef211e40, ftLastAccessTime.dwHighDateTime=0x1d5f0f0, ftLastWriteTime.dwLowDateTime=0x4ad139a8, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17950)) returned 1 [0069.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.474] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\nrgtgaxtrxflmg_.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nRGTGAxtRXflmG_.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\nrgtgaxtrxflmg_.pptx.wholocked")) returned 1 [0069.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", lpFilePart=0x0) returned 0x2f [0069.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.478] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qxjywgczqc3bo1wb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.478] GetFileType (hFile=0x354) returned 0x1 [0069.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.478] GetFileType (hFile=0x354) returned 0x1 [0069.478] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x31c1 [0069.478] ReadFile (in: hFile=0x354, lpBuffer=0x2e3b6c8, nNumberOfBytesToRead=0x31c1, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e3b6c8*, lpNumberOfBytesRead=0xefece8*=0x31c1, lpOverlapped=0x0) returned 1 [0069.479] CloseHandle (hObject=0x354) returned 1 [0069.494] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", lpFilePart=0x0) returned 0x2f [0069.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qxjywgczqc3bo1wb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.495] GetFileType (hFile=0x354) returned 0x1 [0069.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.495] GetFileType (hFile=0x354) returned 0x1 [0069.495] WriteFile (in: hFile=0x354, lpBuffer=0x2e97dc4*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e97dc4*, lpNumberOfBytesWritten=0xefecdc*=0x31d0, lpOverlapped=0x0) returned 1 [0069.566] CloseHandle (hObject=0x354) returned 1 [0069.568] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx", lpFilePart=0x0) returned 0x2f [0069.568] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx.wholocked", lpFilePart=0x0) returned 0x39 [0069.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qxjywgczqc3bo1wb.docx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0a48e0, ftCreationTime.dwHighDateTime=0x1d599d2, ftLastAccessTime.dwLowDateTime=0x35d096f0, ftLastAccessTime.dwHighDateTime=0x1d59cf9, ftLastWriteTime.dwLowDateTime=0x4adf87ec, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x31d0)) returned 1 [0069.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.568] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx" (normalized: "c:\\users\\fd1hvy\\documents\\qxjywgczqc3bo1wb.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\QxJYWGczqc3bo1wB.docx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\qxjywgczqc3bo1wb.docx.wholocked")) returned 1 [0069.568] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", lpFilePart=0x0) returned 0x30 [0069.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.569] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\rs67d--kdchewwhvv8.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.569] GetFileType (hFile=0x354) returned 0x1 [0069.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.569] GetFileType (hFile=0x354) returned 0x1 [0069.569] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xf7ce [0069.569] ReadFile (in: hFile=0x354, lpBuffer=0x2e9b32c, nNumberOfBytesToRead=0xf7ce, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e9b32c*, lpNumberOfBytesRead=0xefece8*=0xf7ce, lpOverlapped=0x0) returned 1 [0069.569] CloseHandle (hObject=0x354) returned 1 [0069.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", lpFilePart=0x0) returned 0x30 [0069.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\rs67d--kdchewwhvv8.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.624] GetFileType (hFile=0x354) returned 0x1 [0069.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.624] GetFileType (hFile=0x354) returned 0x1 [0069.624] WriteFile (in: hFile=0x354, lpBuffer=0x2f1689c*, nNumberOfBytesToWrite=0xf7d0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f1689c*, lpNumberOfBytesWritten=0xefecdc*=0xf7d0, lpOverlapped=0x0) returned 1 [0069.626] CloseHandle (hObject=0x354) returned 1 [0069.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp", lpFilePart=0x0) returned 0x30 [0069.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp.wholocked", lpFilePart=0x0) returned 0x3a [0069.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\rs67d--kdchewwhvv8.odp"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68d8860, ftCreationTime.dwHighDateTime=0x1d5e134, ftLastAccessTime.dwLowDateTime=0x7a16f300, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x4ae91279, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xf7d0)) returned 1 [0069.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.628] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp" (normalized: "c:\\users\\fd1hvy\\documents\\rs67d--kdchewwhvv8.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\rS67d--KDChewWhvv8.odp.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\rs67d--kdchewwhvv8.odp.wholocked")) returned 1 [0069.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", lpFilePart=0x0) returned 0x2d [0069.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\t0fy1qqrnry5dp.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.630] GetFileType (hFile=0x354) returned 0x1 [0069.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.630] GetFileType (hFile=0x354) returned 0x1 [0069.630] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x9125 [0069.630] ReadFile (in: hFile=0x354, lpBuffer=0x2f26408, nNumberOfBytesToRead=0x9125, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f26408*, lpNumberOfBytesRead=0xefece8*=0x9125, lpOverlapped=0x0) returned 1 [0069.630] CloseHandle (hObject=0x354) returned 1 [0069.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", lpFilePart=0x0) returned 0x2d [0069.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.698] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\t0fy1qqrnry5dp.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.699] GetFileType (hFile=0x354) returned 0x1 [0069.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.700] GetFileType (hFile=0x354) returned 0x1 [0069.700] WriteFile (in: hFile=0x354, lpBuffer=0x2fa07e4*, nNumberOfBytesToWrite=0x9130, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2fa07e4*, lpNumberOfBytesWritten=0xefecdc*=0x9130, lpOverlapped=0x0) returned 1 [0069.701] CloseHandle (hObject=0x354) returned 1 [0069.702] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx", lpFilePart=0x0) returned 0x2d [0069.702] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx.wholocked", lpFilePart=0x0) returned 0x37 [0069.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\t0fy1qqrnry5dp.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956a3a80, ftCreationTime.dwHighDateTime=0x1d5691e, ftLastAccessTime.dwLowDateTime=0x270125e0, ftLastAccessTime.dwHighDateTime=0x1d590d8, ftLastWriteTime.dwLowDateTime=0x4af4fe63, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x9130)) returned 1 [0069.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.703] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\t0fy1qqrnry5dp.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\t0fY1QqrnrY5dp.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\t0fy1qqrnry5dp.xlsx.wholocked")) returned 1 [0069.703] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", lpFilePart=0x0) returned 0x24 [0069.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.703] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt" (normalized: "c:\\users\\fd1hvy\\documents\\twtcbx.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.703] GetFileType (hFile=0x354) returned 0x1 [0069.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.703] GetFileType (hFile=0x354) returned 0x1 [0069.703] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x2d29 [0069.704] ReadFile (in: hFile=0x354, lpBuffer=0x2fa9c68, nNumberOfBytesToRead=0x2d29, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2fa9c68*, lpNumberOfBytesRead=0xefece8*=0x2d29, lpOverlapped=0x0) returned 1 [0069.704] CloseHandle (hObject=0x354) returned 1 [0069.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", lpFilePart=0x0) returned 0x24 [0069.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt" (normalized: "c:\\users\\fd1hvy\\documents\\twtcbx.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.722] GetFileType (hFile=0x354) returned 0x1 [0069.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.722] GetFileType (hFile=0x354) returned 0x1 [0069.722] WriteFile (in: hFile=0x354, lpBuffer=0x2e07f84*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e07f84*, lpNumberOfBytesWritten=0xefecdc*=0x2d30, lpOverlapped=0x0) returned 1 [0069.723] CloseHandle (hObject=0x354) returned 1 [0069.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt", lpFilePart=0x0) returned 0x24 [0069.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt.wholocked", lpFilePart=0x0) returned 0x2e [0069.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt" (normalized: "c:\\users\\fd1hvy\\documents\\twtcbx.odt"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd927be0, ftCreationTime.dwHighDateTime=0x1d5e910, ftLastAccessTime.dwLowDateTime=0x77c1d590, ftLastAccessTime.dwHighDateTime=0x1d5e0b2, ftLastWriteTime.dwLowDateTime=0x4af76120, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x2d30)) returned 1 [0069.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.724] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt" (normalized: "c:\\users\\fd1hvy\\documents\\twtcbx.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\TwtcBX.odt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\twtcbx.odt.wholocked")) returned 1 [0069.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", lpFilePart=0x0) returned 0x27 [0069.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xszmeei4x.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.725] GetFileType (hFile=0x354) returned 0x1 [0069.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.725] GetFileType (hFile=0x354) returned 0x1 [0069.725] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x8f27 [0069.725] ReadFile (in: hFile=0x354, lpBuffer=0x2e0afc0, nNumberOfBytesToRead=0x8f27, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e0afc0*, lpNumberOfBytesRead=0xefece8*=0x8f27, lpOverlapped=0x0) returned 1 [0069.726] CloseHandle (hObject=0x354) returned 1 [0069.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", lpFilePart=0x0) returned 0x27 [0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xszmeei4x.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.797] GetFileType (hFile=0x354) returned 0x1 [0069.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.797] GetFileType (hFile=0x354) returned 0x1 [0069.797] WriteFile (in: hFile=0x354, lpBuffer=0x2e84af8*, nNumberOfBytesToWrite=0x8f30, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e84af8*, lpNumberOfBytesWritten=0xefecdc*=0x8f30, lpOverlapped=0x0) returned 1 [0069.799] CloseHandle (hObject=0x354) returned 1 [0069.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc", lpFilePart=0x0) returned 0x27 [0069.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc.wholocked", lpFilePart=0x0) returned 0x31 [0069.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xszmeei4x.doc"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25049530, ftCreationTime.dwHighDateTime=0x1d5e5e0, ftLastAccessTime.dwLowDateTime=0x40a1c7b0, ftLastAccessTime.dwHighDateTime=0x1d5ec0a, ftLastWriteTime.dwLowDateTime=0x4b034c81, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8f30)) returned 1 [0069.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.800] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc" (normalized: "c:\\users\\fd1hvy\\documents\\xszmeei4x.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XsZmeeI4X.doc.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\xszmeei4x.doc.wholocked")) returned 1 [0069.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", lpFilePart=0x0) returned 0x2e [0069.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0069.801] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xyvm1glvyrden8-.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.801] GetFileType (hFile=0x354) returned 0x1 [0069.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.801] GetFileType (hFile=0x354) returned 0x1 [0069.801] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xa822 [0069.801] ReadFile (in: hFile=0x354, lpBuffer=0x2e8dd68, nNumberOfBytesToRead=0xa822, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e8dd68*, lpNumberOfBytesRead=0xefece8*=0xa822, lpOverlapped=0x0) returned 1 [0069.802] CloseHandle (hObject=0x354) returned 1 [0069.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", lpFilePart=0x0) returned 0x2e [0069.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0069.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xyvm1glvyrden8-.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0069.818] GetFileType (hFile=0x354) returned 0x1 [0069.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0069.818] GetFileType (hFile=0x354) returned 0x1 [0069.818] WriteFile (in: hFile=0x354, lpBuffer=0x2efa3f8*, nNumberOfBytesToWrite=0xa830, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2efa3f8*, lpNumberOfBytesWritten=0xefecdc*=0xa830, lpOverlapped=0x0) returned 1 [0069.820] CloseHandle (hObject=0x354) returned 1 [0069.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx", lpFilePart=0x0) returned 0x2e [0069.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx.wholocked", lpFilePart=0x0) returned 0x38 [0069.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0069.821] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xyvm1glvyrden8-.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fa7dd0, ftCreationTime.dwHighDateTime=0x1d5e222, ftLastAccessTime.dwLowDateTime=0x8d3eae40, ftLastAccessTime.dwHighDateTime=0x1d5cd0a, ftLastWriteTime.dwLowDateTime=0x4b05ad3a, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xa830)) returned 1 [0069.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0069.821] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xyvm1glvyrden8-.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\XyvM1gLVYRden8-.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\xyvm1glvyrden8-.xlsx.wholocked")) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0069.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0069.888] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeccc) returned 1 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0069.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.917] GetFileType (hFile=0x354) returned 0x1 [0069.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.917] GetFileType (hFile=0x354) returned 0x1 [0069.919] WriteFile (in: hFile=0x354, lpBuffer=0x2f07d7c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f07d7c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.920] CloseHandle (hObject=0x354) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.921] GetFileType (hFile=0x354) returned 0x1 [0069.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.921] GetFileType (hFile=0x354) returned 0x1 [0069.922] WriteFile (in: hFile=0x354, lpBuffer=0x2f0a8c8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0a8c8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.923] CloseHandle (hObject=0x354) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.923] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.923] GetFileType (hFile=0x354) returned 0x1 [0069.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.923] GetFileType (hFile=0x354) returned 0x1 [0069.923] WriteFile (in: hFile=0x354, lpBuffer=0x2f0d414*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0d414*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.924] CloseHandle (hObject=0x354) returned 1 [0069.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0069.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.925] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.926] GetFileType (hFile=0x354) returned 0x1 [0069.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.926] GetFileType (hFile=0x354) returned 0x1 [0069.926] WriteFile (in: hFile=0x354, lpBuffer=0x2f0ff60*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0ff60*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.927] CloseHandle (hObject=0x354) returned 1 [0069.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0069.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0069.927] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeccc) returned 1 [0069.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0069.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.930] GetFileType (hFile=0x354) returned 0x1 [0069.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.930] GetFileType (hFile=0x354) returned 0x1 [0069.930] WriteFile (in: hFile=0x354, lpBuffer=0x2f133c8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f133c8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.931] CloseHandle (hObject=0x354) returned 1 [0069.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.931] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.932] GetFileType (hFile=0x354) returned 0x1 [0069.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.932] GetFileType (hFile=0x354) returned 0x1 [0069.932] WriteFile (in: hFile=0x354, lpBuffer=0x2f15f14*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f15f14*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.933] CloseHandle (hObject=0x354) returned 1 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.971] GetFileType (hFile=0x354) returned 0x1 [0069.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.971] GetFileType (hFile=0x354) returned 0x1 [0069.971] WriteFile (in: hFile=0x354, lpBuffer=0x2f18a60*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f18a60*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.972] CloseHandle (hObject=0x354) returned 1 [0069.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0069.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.973] GetFileType (hFile=0x354) returned 0x1 [0069.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.973] GetFileType (hFile=0x354) returned 0x1 [0069.973] WriteFile (in: hFile=0x354, lpBuffer=0x2f1b5ac*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f1b5ac*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.974] CloseHandle (hObject=0x354) returned 1 [0069.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0069.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0069.975] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd998 [0069.975] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.976] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.976] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0069.976] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0069.976] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0069.976] FindClose (in: hFindFile=0x12cd998 | out: hFindFile=0x12cd998) returned 1 [0069.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0069.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0069.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0069.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0069.976] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd558 [0069.977] FindNextFileW (in: hFindFile=0x12cd558, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.977] FindNextFileW (in: hFindFile=0x12cd558, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0069.977] FindNextFileW (in: hFindFile=0x12cd558, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0069.977] FindNextFileW (in: hFindFile=0x12cd558, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0069.977] FindNextFileW (in: hFindFile=0x12cd558, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0069.977] FindClose (in: hFindFile=0x12cd558 | out: hFindFile=0x12cd558) returned 1 [0069.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0069.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0069.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0069.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0069.978] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd958 [0069.978] FindNextFileW (in: hFindFile=0x12cd958, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.979] FindNextFileW (in: hFindFile=0x12cd958, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0069.980] FindNextFileW (in: hFindFile=0x12cd958, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0069.980] FindClose (in: hFindFile=0x12cd958 | out: hFindFile=0x12cd958) returned 1 [0069.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0069.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0069.980] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0069.980] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd698 [0069.981] FindNextFileW (in: hFindFile=0x12cd698, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.981] FindNextFileW (in: hFindFile=0x12cd698, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0069.981] FindNextFileW (in: hFindFile=0x12cd698, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0069.981] FindClose (in: hFindFile=0x12cd698 | out: hFindFile=0x12cd698) returned 1 [0069.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0069.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0069.981] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0069.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0069.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.982] GetFileType (hFile=0x354) returned 0x1 [0069.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0069.982] GetFileType (hFile=0x354) returned 0x1 [0069.982] WriteFile (in: hFile=0x354, lpBuffer=0x2f20a38*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f20a38*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0069.983] CloseHandle (hObject=0x354) returned 1 [0069.983] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0069.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.984] GetFileType (hFile=0x354) returned 0x1 [0069.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0069.984] GetFileType (hFile=0x354) returned 0x1 [0069.984] WriteFile (in: hFile=0x354, lpBuffer=0x2f23584*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f23584*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0069.985] CloseHandle (hObject=0x354) returned 1 [0069.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0069.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.986] GetFileType (hFile=0x354) returned 0x1 [0069.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0069.986] GetFileType (hFile=0x354) returned 0x1 [0069.987] WriteFile (in: hFile=0x354, lpBuffer=0x2f260d0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f260d0*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0069.987] CloseHandle (hObject=0x354) returned 1 [0069.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0069.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0069.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.988] GetFileType (hFile=0x354) returned 0x1 [0069.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0069.988] GetFileType (hFile=0x354) returned 0x1 [0069.989] WriteFile (in: hFile=0x354, lpBuffer=0x2f28c1c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f28c1c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0069.989] CloseHandle (hObject=0x354) returned 1 [0069.990] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0069.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.990] GetFileType (hFile=0x354) returned 0x1 [0069.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.990] GetFileType (hFile=0x354) returned 0x1 [0069.991] WriteFile (in: hFile=0x354, lpBuffer=0x2f2b760*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f2b760*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.992] CloseHandle (hObject=0x354) returned 1 [0069.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.993] GetFileType (hFile=0x354) returned 0x1 [0069.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.993] GetFileType (hFile=0x354) returned 0x1 [0069.993] WriteFile (in: hFile=0x354, lpBuffer=0x2f2e2ac*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f2e2ac*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.994] CloseHandle (hObject=0x354) returned 1 [0069.994] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0069.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.995] GetFileType (hFile=0x354) returned 0x1 [0069.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.995] GetFileType (hFile=0x354) returned 0x1 [0069.995] WriteFile (in: hFile=0x354, lpBuffer=0x2f30df8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f30df8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.996] CloseHandle (hObject=0x354) returned 1 [0069.996] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0069.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0069.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.997] GetFileType (hFile=0x354) returned 0x1 [0069.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0069.997] GetFileType (hFile=0x354) returned 0x1 [0069.997] WriteFile (in: hFile=0x354, lpBuffer=0x2f33944*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f33944*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0069.998] CloseHandle (hObject=0x354) returned 1 [0069.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0069.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0069.999] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0069.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeccc) returned 1 [0070.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0070.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0070.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.001] GetFileType (hFile=0x354) returned 0x1 [0070.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0070.001] GetFileType (hFile=0x354) returned 0x1 [0070.001] WriteFile (in: hFile=0x354, lpBuffer=0x2f36d8c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f36d8c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0070.002] CloseHandle (hObject=0x354) returned 1 [0070.002] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0070.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0070.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.003] GetFileType (hFile=0x354) returned 0x1 [0070.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0070.003] GetFileType (hFile=0x354) returned 0x1 [0070.003] WriteFile (in: hFile=0x354, lpBuffer=0x2f398d8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f398d8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0070.004] CloseHandle (hObject=0x354) returned 1 [0070.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0070.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0070.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.005] GetFileType (hFile=0x354) returned 0x1 [0070.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0070.005] GetFileType (hFile=0x354) returned 0x1 [0070.005] WriteFile (in: hFile=0x354, lpBuffer=0x2f3c424*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f3c424*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0070.006] CloseHandle (hObject=0x354) returned 1 [0070.006] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0070.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0070.007] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.007] GetFileType (hFile=0x354) returned 0x1 [0070.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0070.007] GetFileType (hFile=0x354) returned 0x1 [0070.008] WriteFile (in: hFile=0x354, lpBuffer=0x2f3ef70*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f3ef70*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0070.008] CloseHandle (hObject=0x354) returned 1 [0070.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0070.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa", lpFilePart=0x0) returned 0x29 [0070.009] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd618 [0070.009] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.009] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe508d360, ftCreationTime.dwHighDateTime=0x1d5ec74, ftLastAccessTime.dwLowDateTime=0x59cbdc20, ftLastAccessTime.dwHighDateTime=0x1d5e332, ftLastWriteTime.dwLowDateTime=0x59cbdc20, ftLastWriteTime.dwHighDateTime=0x1d5e332, nFileSizeHigh=0x0, nFileSizeLow=0x87a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="-bw rjQ4i_13.rtf", cAlternateFileName="-BWRJQ~1.RTF")) returned 1 [0070.009] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62a340, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0xae573e0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0xae573e0, ftLastWriteTime.dwHighDateTime=0x1d5efe0, nFileSizeHigh=0x0, nFileSizeLow=0x160cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="8IUqIGkHPPSlW1 RYbF.pdf", cAlternateFileName="8IUQIG~1.PDF")) returned 1 [0070.009] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d5e800, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x3ebb8050, ftLastAccessTime.dwHighDateTime=0x1d5ebae, ftLastWriteTime.dwLowDateTime=0x3ebb8050, ftLastWriteTime.dwHighDateTime=0x1d5ebae, nFileSizeHigh=0x0, nFileSizeLow=0xc44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgwfRSAc.csv", cAlternateFileName="")) returned 1 [0070.009] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kG55lBPMCw_K-G8n", cAlternateFileName="KG55LB~1")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623e790, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0x6d601d0, ftLastAccessTime.dwHighDateTime=0x1d5e53a, ftLastWriteTime.dwLowDateTime=0x6d601d0, ftLastWriteTime.dwHighDateTime=0x1d5e53a, nFileSizeHigh=0x0, nFileSizeLow=0x1696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nkSgrZNcpJJ.xlsx", cAlternateFileName="NKSGRZ~1.XLS")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3515f10, ftCreationTime.dwHighDateTime=0x1d5e944, ftLastAccessTime.dwLowDateTime=0x4d664510, ftLastAccessTime.dwHighDateTime=0x1d5e3c8, ftLastWriteTime.dwLowDateTime=0x4d664510, ftLastWriteTime.dwHighDateTime=0x1d5e3c8, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="o9ih1N.pps", cAlternateFileName="")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OlVsMBM", cAlternateFileName="")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7994ac80, ftCreationTime.dwHighDateTime=0x1d5e2f1, ftLastAccessTime.dwLowDateTime=0xafbe7700, ftLastAccessTime.dwHighDateTime=0x1d5f115, ftLastWriteTime.dwLowDateTime=0xafbe7700, ftLastWriteTime.dwHighDateTime=0x1d5f115, nFileSizeHigh=0x0, nFileSizeLow=0xffae, dwReserved0=0x0, dwReserved1=0x0, cFileName="sLVQqkeFmY-wbzh Mv.pdf", cAlternateFileName="SLVQQK~1.PDF")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="T1nlgU2Emv-mTJhJN7m", cAlternateFileName="T1NLGU~1")) returned 1 [0070.010] FindNextFileW (in: hFindFile=0x12cd618, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="T1nlgU2Emv-mTJhJN7m", cAlternateFileName="T1NLGU~1")) returned 0 [0070.010] FindClose (in: hFindFile=0x12cd618 | out: hFindFile=0x12cd618) returned 1 [0070.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0070.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0070.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0070.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa", lpFilePart=0x0) returned 0x29 [0070.011] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd518 [0070.011] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12a68ae0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x59b14b60, ftLastAccessTime.dwHighDateTime=0x1d5f07c, ftLastWriteTime.dwLowDateTime=0x59b14b60, ftLastWriteTime.dwHighDateTime=0x1d5f07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.011] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe508d360, ftCreationTime.dwHighDateTime=0x1d5ec74, ftLastAccessTime.dwLowDateTime=0x59cbdc20, ftLastAccessTime.dwHighDateTime=0x1d5e332, ftLastWriteTime.dwLowDateTime=0x59cbdc20, ftLastWriteTime.dwHighDateTime=0x1d5e332, nFileSizeHigh=0x0, nFileSizeLow=0x87a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="-bw rjQ4i_13.rtf", cAlternateFileName="-BWRJQ~1.RTF")) returned 1 [0070.011] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62a340, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0xae573e0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0xae573e0, ftLastWriteTime.dwHighDateTime=0x1d5efe0, nFileSizeHigh=0x0, nFileSizeLow=0x160cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="8IUqIGkHPPSlW1 RYbF.pdf", cAlternateFileName="8IUQIG~1.PDF")) returned 1 [0070.011] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d5e800, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x3ebb8050, ftLastAccessTime.dwHighDateTime=0x1d5ebae, ftLastWriteTime.dwLowDateTime=0x3ebb8050, ftLastWriteTime.dwHighDateTime=0x1d5ebae, nFileSizeHigh=0x0, nFileSizeLow=0xc44e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgwfRSAc.csv", cAlternateFileName="")) returned 1 [0070.076] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kG55lBPMCw_K-G8n", cAlternateFileName="KG55LB~1")) returned 1 [0070.076] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623e790, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0x6d601d0, ftLastAccessTime.dwHighDateTime=0x1d5e53a, ftLastWriteTime.dwLowDateTime=0x6d601d0, ftLastWriteTime.dwHighDateTime=0x1d5e53a, nFileSizeHigh=0x0, nFileSizeLow=0x1696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nkSgrZNcpJJ.xlsx", cAlternateFileName="NKSGRZ~1.XLS")) returned 1 [0070.076] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3515f10, ftCreationTime.dwHighDateTime=0x1d5e944, ftLastAccessTime.dwLowDateTime=0x4d664510, ftLastAccessTime.dwHighDateTime=0x1d5e3c8, ftLastWriteTime.dwLowDateTime=0x4d664510, ftLastWriteTime.dwHighDateTime=0x1d5e3c8, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="o9ih1N.pps", cAlternateFileName="")) returned 1 [0070.076] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OlVsMBM", cAlternateFileName="")) returned 1 [0070.076] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7994ac80, ftCreationTime.dwHighDateTime=0x1d5e2f1, ftLastAccessTime.dwLowDateTime=0xafbe7700, ftLastAccessTime.dwHighDateTime=0x1d5f115, ftLastWriteTime.dwLowDateTime=0xafbe7700, ftLastWriteTime.dwHighDateTime=0x1d5f115, nFileSizeHigh=0x0, nFileSizeLow=0xffae, dwReserved0=0x0, dwReserved1=0x0, cFileName="sLVQqkeFmY-wbzh Mv.pdf", cAlternateFileName="SLVQQK~1.PDF")) returned 1 [0070.077] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="T1nlgU2Emv-mTJhJN7m", cAlternateFileName="T1NLGU~1")) returned 1 [0070.077] FindNextFileW (in: hFindFile=0x12cd518, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0070.077] FindClose (in: hFindFile=0x12cd518 | out: hFindFile=0x12cd518) returned 1 [0070.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0070.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0070.077] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", lpFilePart=0x0) returned 0x3a [0070.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0070.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\-bw rjq4i_13.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.077] GetFileType (hFile=0x354) returned 0x1 [0070.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0070.077] GetFileType (hFile=0x354) returned 0x1 [0070.077] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x87a3 [0070.077] ReadFile (in: hFile=0x354, lpBuffer=0x2f42bc0, nNumberOfBytesToRead=0x87a3, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f42bc0*, lpNumberOfBytesRead=0xefec60*=0x87a3, lpOverlapped=0x0) returned 1 [0070.078] CloseHandle (hObject=0x354) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", lpFilePart=0x0) returned 0x3a [0070.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0070.218] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\-bw rjq4i_13.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.220] GetFileType (hFile=0x354) returned 0x1 [0070.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0070.220] GetFileType (hFile=0x354) returned 0x1 [0070.220] WriteFile (in: hFile=0x354, lpBuffer=0x2fba01c*, nNumberOfBytesToWrite=0x87b0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fba01c*, lpNumberOfBytesWritten=0xefec54*=0x87b0, lpOverlapped=0x0) returned 1 [0070.221] CloseHandle (hObject=0x354) returned 1 [0070.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf", lpFilePart=0x0) returned 0x3a [0070.223] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf.wholocked", lpFilePart=0x0) returned 0x44 [0070.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0070.223] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\-bw rjq4i_13.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe508d360, ftCreationTime.dwHighDateTime=0x1d5ec74, ftLastAccessTime.dwLowDateTime=0x59cbdc20, ftLastAccessTime.dwHighDateTime=0x1d5e332, ftLastWriteTime.dwLowDateTime=0x4b43aa4c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x87b0)) returned 1 [0070.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0070.223] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\-bw rjq4i_13.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\-bw rjQ4i_13.rtf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\-bw rjq4i_13.rtf.wholocked")) returned 1 [0070.224] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", lpFilePart=0x0) returned 0x41 [0070.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0070.224] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\8iuqigkhppslw1 rybf.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.224] GetFileType (hFile=0x354) returned 0x1 [0070.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0070.224] GetFileType (hFile=0x354) returned 0x1 [0070.224] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x160cc [0070.224] ReadFile (in: hFile=0x354, lpBuffer=0x3feed08, nNumberOfBytesToRead=0x160cc, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x3feed08*, lpNumberOfBytesRead=0xefec60*=0x160cc, lpOverlapped=0x0) returned 1 [0070.225] CloseHandle (hObject=0x354) returned 1 [0070.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", lpFilePart=0x0) returned 0x41 [0070.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0070.419] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\8iuqigkhppslw1 rybf.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.422] GetFileType (hFile=0x354) returned 0x1 [0070.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0070.422] GetFileType (hFile=0x354) returned 0x1 [0070.422] WriteFile (in: hFile=0x354, lpBuffer=0x41250b8*, nNumberOfBytesToWrite=0x160d0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x41250b8*, lpNumberOfBytesWritten=0xefec54*=0x160d0, lpOverlapped=0x0) returned 1 [0070.424] CloseHandle (hObject=0x354) returned 1 [0070.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf", lpFilePart=0x0) returned 0x41 [0070.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf.wholocked", lpFilePart=0x0) returned 0x4b [0070.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0070.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\8iuqigkhppslw1 rybf.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62a340, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0xae573e0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0x4b62aaef, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x160d0)) returned 1 [0070.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0070.427] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\8iuqigkhppslw1 rybf.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\8IUqIGkHPPSlW1 RYbF.pdf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\8iuqigkhppslw1 rybf.pdf.wholocked")) returned 1 [0070.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", lpFilePart=0x0) returned 0x36 [0070.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0070.428] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\fgwfrsac.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.428] GetFileType (hFile=0x354) returned 0x1 [0070.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0070.428] GetFileType (hFile=0x354) returned 0x1 [0070.428] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xc44e [0070.428] ReadFile (in: hFile=0x354, lpBuffer=0x2e17174, nNumberOfBytesToRead=0xc44e, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2e17174*, lpNumberOfBytesRead=0xefec60*=0xc44e, lpOverlapped=0x0) returned 1 [0070.429] CloseHandle (hObject=0x354) returned 1 [0070.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", lpFilePart=0x0) returned 0x36 [0070.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0070.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\fgwfrsac.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.448] GetFileType (hFile=0x354) returned 0x1 [0070.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0070.448] GetFileType (hFile=0x354) returned 0x1 [0070.448] WriteFile (in: hFile=0x354, lpBuffer=0x2e88dc0*, nNumberOfBytesToWrite=0xc450, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e88dc0*, lpNumberOfBytesWritten=0xefec54*=0xc450, lpOverlapped=0x0) returned 1 [0070.567] CloseHandle (hObject=0x354) returned 1 [0070.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv", lpFilePart=0x0) returned 0x36 [0070.569] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv.wholocked", lpFilePart=0x0) returned 0x40 [0070.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0070.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\fgwfrsac.csv"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d5e800, ftCreationTime.dwHighDateTime=0x1d5eaec, ftLastAccessTime.dwLowDateTime=0x3ebb8050, ftLastAccessTime.dwHighDateTime=0x1d5ebae, ftLastWriteTime.dwLowDateTime=0x4b781f5f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xc450)) returned 1 [0070.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0070.569] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\fgwfrsac.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\FgwfRSAc.csv.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\fgwfrsac.csv.wholocked")) returned 1 [0070.570] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", lpFilePart=0x0) returned 0x3a [0070.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0070.570] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\nksgrzncpjj.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.570] GetFileType (hFile=0x354) returned 0x1 [0070.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0070.570] GetFileType (hFile=0x354) returned 0x1 [0070.570] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x1696d [0070.571] ReadFile (in: hFile=0x354, lpBuffer=0x4153a48, nNumberOfBytesToRead=0x1696d, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x4153a48*, lpNumberOfBytesRead=0xefec60*=0x1696d, lpOverlapped=0x0) returned 1 [0070.572] CloseHandle (hObject=0x354) returned 1 [0070.593] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", lpFilePart=0x0) returned 0x3a [0070.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0070.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\nksgrzncpjj.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.595] GetFileType (hFile=0x354) returned 0x1 [0070.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0070.595] GetFileType (hFile=0x354) returned 0x1 [0070.595] WriteFile (in: hFile=0x354, lpBuffer=0x3e0c448*, nNumberOfBytesToWrite=0x16970, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x3e0c448*, lpNumberOfBytesWritten=0xefec54*=0x16970, lpOverlapped=0x0) returned 1 [0070.597] CloseHandle (hObject=0x354) returned 1 [0070.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx", lpFilePart=0x0) returned 0x3a [0070.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx.wholocked", lpFilePart=0x0) returned 0x44 [0070.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0070.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\nksgrzncpjj.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4623e790, ftCreationTime.dwHighDateTime=0x1d5e791, ftLastAccessTime.dwLowDateTime=0x6d601d0, ftLastAccessTime.dwHighDateTime=0x1d5e53a, ftLastWriteTime.dwLowDateTime=0x4b7ce432, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x16970)) returned 1 [0070.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0070.599] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\nksgrzncpjj.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\nkSgrZNcpJJ.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\nksgrzncpjj.xlsx.wholocked")) returned 1 [0070.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", lpFilePart=0x0) returned 0x40 [0070.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0070.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\slvqqkefmy-wbzh mv.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.600] GetFileType (hFile=0x354) returned 0x1 [0070.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0070.600] GetFileType (hFile=0x354) returned 0x1 [0070.600] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xffae [0070.600] ReadFile (in: hFile=0x354, lpBuffer=0x2dcf2dc, nNumberOfBytesToRead=0xffae, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2dcf2dc*, lpNumberOfBytesRead=0xefec60*=0xffae, lpOverlapped=0x0) returned 1 [0070.601] CloseHandle (hObject=0x354) returned 1 [0070.753] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", lpFilePart=0x0) returned 0x40 [0070.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0070.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\slvqqkefmy-wbzh mv.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.755] GetFileType (hFile=0x354) returned 0x1 [0070.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0070.755] GetFileType (hFile=0x354) returned 0x1 [0070.755] WriteFile (in: hFile=0x354, lpBuffer=0x2e4c148*, nNumberOfBytesToWrite=0xffb0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e4c148*, lpNumberOfBytesWritten=0xefec54*=0xffb0, lpOverlapped=0x0) returned 1 [0070.757] CloseHandle (hObject=0x354) returned 1 [0070.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf", lpFilePart=0x0) returned 0x40 [0070.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf.wholocked", lpFilePart=0x0) returned 0x4a [0070.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0070.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\slvqqkefmy-wbzh mv.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7994ac80, ftCreationTime.dwHighDateTime=0x1d5e2f1, ftLastAccessTime.dwLowDateTime=0xafbe7700, ftLastAccessTime.dwHighDateTime=0x1d5f115, ftLastWriteTime.dwLowDateTime=0x4b94bbed, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xffb0)) returned 1 [0070.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0070.759] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\slvqqkefmy-wbzh mv.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\sLVQqkeFmY-wbzh Mv.pdf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\slvqqkefmy-wbzh mv.pdf.wholocked")) returned 1 [0070.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0070.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n", lpFilePart=0x0) returned 0x3a [0070.760] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd998 [0070.760] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.760] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa366d7b0, ftCreationTime.dwHighDateTime=0x1d5e15a, ftLastAccessTime.dwLowDateTime=0xdabcf6f0, ftLastAccessTime.dwHighDateTime=0x1d5efaf, ftLastWriteTime.dwLowDateTime=0xdabcf6f0, ftLastWriteTime.dwHighDateTime=0x1d5efaf, nFileSizeHigh=0x0, nFileSizeLow=0x11586, dwReserved0=0x0, dwReserved1=0x0, cFileName="AI_B6_4hctmkKwD4ur.rtf", cAlternateFileName="AI_B6_~1.RTF")) returned 1 [0070.760] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80ae6430, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x98b988f0, ftLastAccessTime.dwHighDateTime=0x1d5ed6a, ftLastWriteTime.dwLowDateTime=0x98b988f0, ftLastWriteTime.dwHighDateTime=0x1d5ed6a, nFileSizeHigh=0x0, nFileSizeLow=0x9d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="eUJCiaz9lO_PM5.ots", cAlternateFileName="EUJCIA~1.OTS")) returned 1 [0070.760] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd337b40, ftCreationTime.dwHighDateTime=0x1d5f0cc, ftLastAccessTime.dwLowDateTime=0xc1ac72b0, ftLastAccessTime.dwHighDateTime=0x1d5e728, ftLastWriteTime.dwLowDateTime=0xc1ac72b0, ftLastWriteTime.dwHighDateTime=0x1d5e728, nFileSizeHigh=0x0, nFileSizeLow=0xd23d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jw_YVhVNxG-bLhjZB.pps", cAlternateFileName="JW_YVH~1.PPS")) returned 1 [0070.760] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ca7480, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x4c8fe20, ftLastAccessTime.dwHighDateTime=0x1d5e9f8, ftLastWriteTime.dwLowDateTime=0x4c8fe20, ftLastWriteTime.dwHighDateTime=0x1d5e9f8, nFileSizeHigh=0x0, nFileSizeLow=0x17615, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IbpzkmGLnTpI.rtf", cAlternateFileName="_IBPZK~1.RTF")) returned 1 [0070.761] FindNextFileW (in: hFindFile=0x12cd998, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0070.761] FindClose (in: hFindFile=0x12cd998 | out: hFindFile=0x12cd998) returned 1 [0070.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0070.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0070.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0070.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n", lpFilePart=0x0) returned 0x3a [0070.761] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd398 [0070.761] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc77040, ftCreationTime.dwHighDateTime=0x1d5e4dd, ftLastAccessTime.dwLowDateTime=0xba198f70, ftLastAccessTime.dwHighDateTime=0x1d5ec4a, ftLastWriteTime.dwLowDateTime=0xba198f70, ftLastWriteTime.dwHighDateTime=0x1d5ec4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.762] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa366d7b0, ftCreationTime.dwHighDateTime=0x1d5e15a, ftLastAccessTime.dwLowDateTime=0xdabcf6f0, ftLastAccessTime.dwHighDateTime=0x1d5efaf, ftLastWriteTime.dwLowDateTime=0xdabcf6f0, ftLastWriteTime.dwHighDateTime=0x1d5efaf, nFileSizeHigh=0x0, nFileSizeLow=0x11586, dwReserved0=0x0, dwReserved1=0x0, cFileName="AI_B6_4hctmkKwD4ur.rtf", cAlternateFileName="AI_B6_~1.RTF")) returned 1 [0070.762] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80ae6430, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x98b988f0, ftLastAccessTime.dwHighDateTime=0x1d5ed6a, ftLastWriteTime.dwLowDateTime=0x98b988f0, ftLastWriteTime.dwHighDateTime=0x1d5ed6a, nFileSizeHigh=0x0, nFileSizeLow=0x9d37, dwReserved0=0x0, dwReserved1=0x0, cFileName="eUJCiaz9lO_PM5.ots", cAlternateFileName="EUJCIA~1.OTS")) returned 1 [0070.762] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd337b40, ftCreationTime.dwHighDateTime=0x1d5f0cc, ftLastAccessTime.dwLowDateTime=0xc1ac72b0, ftLastAccessTime.dwHighDateTime=0x1d5e728, ftLastWriteTime.dwLowDateTime=0xc1ac72b0, ftLastWriteTime.dwHighDateTime=0x1d5e728, nFileSizeHigh=0x0, nFileSizeLow=0xd23d, dwReserved0=0x0, dwReserved1=0x0, cFileName="jw_YVhVNxG-bLhjZB.pps", cAlternateFileName="JW_YVH~1.PPS")) returned 1 [0070.762] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ca7480, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x4c8fe20, ftLastAccessTime.dwHighDateTime=0x1d5e9f8, ftLastWriteTime.dwLowDateTime=0x4c8fe20, ftLastWriteTime.dwHighDateTime=0x1d5e9f8, nFileSizeHigh=0x0, nFileSizeLow=0x17615, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IbpzkmGLnTpI.rtf", cAlternateFileName="_IBPZK~1.RTF")) returned 1 [0070.763] FindNextFileW (in: hFindFile=0x12cd398, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ca7480, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x4c8fe20, ftLastAccessTime.dwHighDateTime=0x1d5e9f8, ftLastWriteTime.dwLowDateTime=0x4c8fe20, ftLastWriteTime.dwHighDateTime=0x1d5e9f8, nFileSizeHigh=0x0, nFileSizeLow=0x17615, dwReserved0=0x0, dwReserved1=0x0, cFileName="_IbpzkmGLnTpI.rtf", cAlternateFileName="_IBPZK~1.RTF")) returned 0 [0070.763] FindClose (in: hFindFile=0x12cd398 | out: hFindFile=0x12cd398) returned 1 [0070.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0070.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0070.763] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", lpFilePart=0x0) returned 0x51 [0070.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0070.763] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\ai_b6_4hctmkkwd4ur.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.763] GetFileType (hFile=0x354) returned 0x1 [0070.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0070.763] GetFileType (hFile=0x354) returned 0x1 [0070.763] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x11586 [0070.763] ReadFile (in: hFile=0x354, lpBuffer=0x2e5e784, nNumberOfBytesToRead=0x11586, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e5e784*, lpNumberOfBytesRead=0xefebd8*=0x11586, lpOverlapped=0x0) returned 1 [0070.764] CloseHandle (hObject=0x354) returned 1 [0070.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", lpFilePart=0x0) returned 0x51 [0070.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0070.780] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\ai_b6_4hctmkkwd4ur.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.781] GetFileType (hFile=0x354) returned 0x1 [0070.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0070.781] GetFileType (hFile=0x354) returned 0x1 [0070.781] WriteFile (in: hFile=0x354, lpBuffer=0x2edf634*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2edf634*, lpNumberOfBytesWritten=0xefebcc*=0x11590, lpOverlapped=0x0) returned 1 [0070.783] CloseHandle (hObject=0x354) returned 1 [0070.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf", lpFilePart=0x0) returned 0x51 [0070.785] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf.wholocked", lpFilePart=0x0) returned 0x5b [0070.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0070.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\ai_b6_4hctmkkwd4ur.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa366d7b0, ftCreationTime.dwHighDateTime=0x1d5e15a, ftLastAccessTime.dwLowDateTime=0xdabcf6f0, ftLastAccessTime.dwHighDateTime=0x1d5efaf, ftLastWriteTime.dwLowDateTime=0x4b9980cb, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x11590)) returned 1 [0070.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0070.785] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\ai_b6_4hctmkkwd4ur.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\AI_B6_4hctmkKwD4ur.rtf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\ai_b6_4hctmkkwd4ur.rtf.wholocked")) returned 1 [0070.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", lpFilePart=0x0) returned 0x4c [0070.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0070.786] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\_ibpzkmglntpi.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.786] GetFileType (hFile=0x354) returned 0x1 [0070.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0070.786] GetFileType (hFile=0x354) returned 0x1 [0070.786] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x17615 [0070.786] ReadFile (in: hFile=0x354, lpBuffer=0x3e65858, nNumberOfBytesToRead=0x17615, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x3e65858*, lpNumberOfBytesRead=0xefebd8*=0x17615, lpOverlapped=0x0) returned 1 [0070.787] CloseHandle (hObject=0x354) returned 1 [0070.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", lpFilePart=0x0) returned 0x4c [0070.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0070.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\_ibpzkmglntpi.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.863] GetFileType (hFile=0x354) returned 0x1 [0070.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0070.863] GetFileType (hFile=0x354) returned 0x1 [0070.863] WriteFile (in: hFile=0x354, lpBuffer=0x3eda730*, nNumberOfBytesToWrite=0x17620, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3eda730*, lpNumberOfBytesWritten=0xefebcc*=0x17620, lpOverlapped=0x0) returned 1 [0070.865] CloseHandle (hObject=0x354) returned 1 [0070.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf", lpFilePart=0x0) returned 0x4c [0070.868] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf.wholocked", lpFilePart=0x0) returned 0x56 [0070.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0070.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\_ibpzkmglntpi.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ca7480, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x4c8fe20, ftLastAccessTime.dwHighDateTime=0x1d5e9f8, ftLastWriteTime.dwLowDateTime=0x4ba56c65, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17620)) returned 1 [0070.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0070.868] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\_ibpzkmglntpi.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\kG55lBPMCw_K-G8n\\_IbpzkmGLnTpI.rtf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\kg55lbpmcw_k-g8n\\_ibpzkmglntpi.rtf.wholocked")) returned 1 [0070.869] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0070.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0070.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.870] GetFileType (hFile=0x354) returned 0x1 [0070.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0070.870] GetFileType (hFile=0x354) returned 0x1 [0070.870] WriteFile (in: hFile=0x354, lpBuffer=0x2f3fd5c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f3fd5c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0070.872] CloseHandle (hObject=0x354) returned 1 [0070.872] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0070.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0070.872] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.873] GetFileType (hFile=0x354) returned 0x1 [0070.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0070.873] GetFileType (hFile=0x354) returned 0x1 [0070.873] WriteFile (in: hFile=0x354, lpBuffer=0x2f428a8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f428a8*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0070.874] CloseHandle (hObject=0x354) returned 1 [0070.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0070.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0070.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.875] GetFileType (hFile=0x354) returned 0x1 [0070.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0070.875] GetFileType (hFile=0x354) returned 0x1 [0070.876] WriteFile (in: hFile=0x354, lpBuffer=0x2f453f4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f453f4*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0070.876] CloseHandle (hObject=0x354) returned 1 [0070.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0070.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0070.877] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0070.878] GetFileType (hFile=0x354) returned 0x1 [0070.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0070.878] GetFileType (hFile=0x354) returned 0x1 [0070.878] WriteFile (in: hFile=0x354, lpBuffer=0x2f47f40*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f47f40*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0070.879] CloseHandle (hObject=0x354) returned 1 [0070.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0070.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM", lpFilePart=0x0) returned 0x31 [0070.879] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cda18 [0070.879] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.879] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36291f90, ftCreationTime.dwHighDateTime=0x1d5e629, ftLastAccessTime.dwLowDateTime=0x21648790, ftLastAccessTime.dwHighDateTime=0x1d5f103, ftLastWriteTime.dwLowDateTime=0x21648790, ftLastWriteTime.dwHighDateTime=0x1d5f103, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="-7iY.ppt", cAlternateFileName="")) returned 1 [0070.879] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c3c8ed0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x1a4815e0, ftLastAccessTime.dwHighDateTime=0x1d5e8c9, ftLastWriteTime.dwLowDateTime=0x1a4815e0, ftLastWriteTime.dwHighDateTime=0x1d5e8c9, nFileSizeHigh=0x0, nFileSizeLow=0x5644, dwReserved0=0x0, dwReserved1=0x0, cFileName="22u41.odp", cAlternateFileName="")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb22c920, ftCreationTime.dwHighDateTime=0x1d5e916, ftLastAccessTime.dwLowDateTime=0x41614260, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0x41614260, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0x587f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4FPFf_cIuK4V.xlsx", cAlternateFileName="4FPFF_~1.XLS")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2672710, ftCreationTime.dwHighDateTime=0x1d5e1e6, ftLastAccessTime.dwLowDateTime=0x50f077c0, ftLastAccessTime.dwHighDateTime=0x1d5ea1f, ftLastWriteTime.dwLowDateTime=0x50f077c0, ftLastWriteTime.dwHighDateTime=0x1d5ea1f, nFileSizeHigh=0x0, nFileSizeLow=0xde22, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQg KvKXQJq-mMm.pps", cAlternateFileName="CQGKVK~1.PPS")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ba13c40, ftCreationTime.dwHighDateTime=0x1d5e79b, ftLastAccessTime.dwLowDateTime=0xb2d2ead0, ftLastAccessTime.dwHighDateTime=0x1d5eaf2, ftLastWriteTime.dwLowDateTime=0xb2d2ead0, ftLastWriteTime.dwHighDateTime=0x1d5eaf2, nFileSizeHigh=0x0, nFileSizeLow=0x1836e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JHn3Cb0Az2vhCDqjvK_3.pps", cAlternateFileName="JHN3CB~1.PPS")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb93a020, ftCreationTime.dwHighDateTime=0x1d5ead4, ftLastAccessTime.dwLowDateTime=0x42863900, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x42863900, ftLastWriteTime.dwHighDateTime=0x1d5e8f2, nFileSizeHigh=0x0, nFileSizeLow=0x18896, dwReserved0=0x0, dwReserved1=0x0, cFileName="JXB7.pptx", cAlternateFileName="JXB7~1.PPT")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50e4aa90, ftCreationTime.dwHighDateTime=0x1d5ecd5, ftLastAccessTime.dwLowDateTime=0xa7f87ea0, ftLastAccessTime.dwHighDateTime=0x1d5e498, ftLastWriteTime.dwLowDateTime=0xa7f87ea0, ftLastWriteTime.dwHighDateTime=0x1d5e498, nFileSizeHigh=0x0, nFileSizeLow=0x180cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="kYL-zGW-Hli7Dp.odt", cAlternateFileName="KYL-ZG~1.ODT")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66ad0b0, ftCreationTime.dwHighDateTime=0x1d5edae, ftLastAccessTime.dwLowDateTime=0x8da00a20, ftLastAccessTime.dwHighDateTime=0x1d5ef22, ftLastWriteTime.dwLowDateTime=0x8da00a20, ftLastWriteTime.dwHighDateTime=0x1d5ef22, nFileSizeHigh=0x0, nFileSizeLow=0x8a66, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3QI_jCS-.pptx", cAlternateFileName="L3QI_J~1.PPT")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6105a340, ftCreationTime.dwHighDateTime=0x1d5e33c, ftLastAccessTime.dwLowDateTime=0xa11ffa10, ftLastAccessTime.dwHighDateTime=0x1d5e6ee, ftLastWriteTime.dwLowDateTime=0xa11ffa10, ftLastWriteTime.dwHighDateTime=0x1d5e6ee, nFileSizeHigh=0x0, nFileSizeLow=0x145db, dwReserved0=0x0, dwReserved1=0x0, cFileName="MG8_t.pps", cAlternateFileName="")) returned 1 [0070.880] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2453890, ftCreationTime.dwHighDateTime=0x1d5e805, ftLastAccessTime.dwLowDateTime=0xa7385e70, ftLastAccessTime.dwHighDateTime=0x1d5e391, ftLastWriteTime.dwLowDateTime=0xa7385e70, ftLastWriteTime.dwHighDateTime=0x1d5e391, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="t5ysJXZHZRDcoR7-B.odt", cAlternateFileName="T5YSJX~1.ODT")) returned 1 [0070.881] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64318e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x5f41d3f0, ftLastAccessTime.dwHighDateTime=0x1d5e15f, ftLastWriteTime.dwLowDateTime=0x5f41d3f0, ftLastWriteTime.dwHighDateTime=0x1d5e15f, nFileSizeHigh=0x0, nFileSizeLow=0x114f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y00DAc moOje.rtf", cAlternateFileName="Y00DAC~1.RTF")) returned 1 [0070.881] FindNextFileW (in: hFindFile=0x12cda18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0070.881] FindClose (in: hFindFile=0x12cda18 | out: hFindFile=0x12cda18) returned 1 [0070.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0070.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0070.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0070.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM", lpFilePart=0x0) returned 0x31 [0070.881] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd3d8 [0070.881] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd1facf0, ftCreationTime.dwHighDateTime=0x1d5f04f, ftLastAccessTime.dwLowDateTime=0x27f7b3b0, ftLastAccessTime.dwHighDateTime=0x1d5e673, ftLastWriteTime.dwLowDateTime=0x27f7b3b0, ftLastWriteTime.dwHighDateTime=0x1d5e673, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.881] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36291f90, ftCreationTime.dwHighDateTime=0x1d5e629, ftLastAccessTime.dwLowDateTime=0x21648790, ftLastAccessTime.dwHighDateTime=0x1d5f103, ftLastWriteTime.dwLowDateTime=0x21648790, ftLastWriteTime.dwHighDateTime=0x1d5f103, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x0, cFileName="-7iY.ppt", cAlternateFileName="")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c3c8ed0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x1a4815e0, ftLastAccessTime.dwHighDateTime=0x1d5e8c9, ftLastWriteTime.dwLowDateTime=0x1a4815e0, ftLastWriteTime.dwHighDateTime=0x1d5e8c9, nFileSizeHigh=0x0, nFileSizeLow=0x5644, dwReserved0=0x0, dwReserved1=0x0, cFileName="22u41.odp", cAlternateFileName="")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb22c920, ftCreationTime.dwHighDateTime=0x1d5e916, ftLastAccessTime.dwLowDateTime=0x41614260, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0x41614260, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0x587f, dwReserved0=0x0, dwReserved1=0x0, cFileName="4FPFf_cIuK4V.xlsx", cAlternateFileName="4FPFF_~1.XLS")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2672710, ftCreationTime.dwHighDateTime=0x1d5e1e6, ftLastAccessTime.dwLowDateTime=0x50f077c0, ftLastAccessTime.dwHighDateTime=0x1d5ea1f, ftLastWriteTime.dwLowDateTime=0x50f077c0, ftLastWriteTime.dwHighDateTime=0x1d5ea1f, nFileSizeHigh=0x0, nFileSizeLow=0xde22, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQg KvKXQJq-mMm.pps", cAlternateFileName="CQGKVK~1.PPS")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ba13c40, ftCreationTime.dwHighDateTime=0x1d5e79b, ftLastAccessTime.dwLowDateTime=0xb2d2ead0, ftLastAccessTime.dwHighDateTime=0x1d5eaf2, ftLastWriteTime.dwLowDateTime=0xb2d2ead0, ftLastWriteTime.dwHighDateTime=0x1d5eaf2, nFileSizeHigh=0x0, nFileSizeLow=0x1836e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JHn3Cb0Az2vhCDqjvK_3.pps", cAlternateFileName="JHN3CB~1.PPS")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb93a020, ftCreationTime.dwHighDateTime=0x1d5ead4, ftLastAccessTime.dwLowDateTime=0x42863900, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x42863900, ftLastWriteTime.dwHighDateTime=0x1d5e8f2, nFileSizeHigh=0x0, nFileSizeLow=0x18896, dwReserved0=0x0, dwReserved1=0x0, cFileName="JXB7.pptx", cAlternateFileName="JXB7~1.PPT")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50e4aa90, ftCreationTime.dwHighDateTime=0x1d5ecd5, ftLastAccessTime.dwLowDateTime=0xa7f87ea0, ftLastAccessTime.dwHighDateTime=0x1d5e498, ftLastWriteTime.dwLowDateTime=0xa7f87ea0, ftLastWriteTime.dwHighDateTime=0x1d5e498, nFileSizeHigh=0x0, nFileSizeLow=0x180cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="kYL-zGW-Hli7Dp.odt", cAlternateFileName="KYL-ZG~1.ODT")) returned 1 [0070.882] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66ad0b0, ftCreationTime.dwHighDateTime=0x1d5edae, ftLastAccessTime.dwLowDateTime=0x8da00a20, ftLastAccessTime.dwHighDateTime=0x1d5ef22, ftLastWriteTime.dwLowDateTime=0x8da00a20, ftLastWriteTime.dwHighDateTime=0x1d5ef22, nFileSizeHigh=0x0, nFileSizeLow=0x8a66, dwReserved0=0x0, dwReserved1=0x0, cFileName="L3QI_jCS-.pptx", cAlternateFileName="L3QI_J~1.PPT")) returned 1 [0070.883] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6105a340, ftCreationTime.dwHighDateTime=0x1d5e33c, ftLastAccessTime.dwLowDateTime=0xa11ffa10, ftLastAccessTime.dwHighDateTime=0x1d5e6ee, ftLastWriteTime.dwLowDateTime=0xa11ffa10, ftLastWriteTime.dwHighDateTime=0x1d5e6ee, nFileSizeHigh=0x0, nFileSizeLow=0x145db, dwReserved0=0x0, dwReserved1=0x0, cFileName="MG8_t.pps", cAlternateFileName="")) returned 1 [0070.883] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2453890, ftCreationTime.dwHighDateTime=0x1d5e805, ftLastAccessTime.dwLowDateTime=0xa7385e70, ftLastAccessTime.dwHighDateTime=0x1d5e391, ftLastWriteTime.dwLowDateTime=0xa7385e70, ftLastWriteTime.dwHighDateTime=0x1d5e391, nFileSizeHigh=0x0, nFileSizeLow=0xbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="t5ysJXZHZRDcoR7-B.odt", cAlternateFileName="T5YSJX~1.ODT")) returned 1 [0070.883] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64318e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x5f41d3f0, ftLastAccessTime.dwHighDateTime=0x1d5e15f, ftLastWriteTime.dwLowDateTime=0x5f41d3f0, ftLastWriteTime.dwHighDateTime=0x1d5e15f, nFileSizeHigh=0x0, nFileSizeLow=0x114f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y00DAc moOje.rtf", cAlternateFileName="Y00DAC~1.RTF")) returned 1 [0070.883] FindNextFileW (in: hFindFile=0x12cd3d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64318e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x5f41d3f0, ftLastAccessTime.dwHighDateTime=0x1d5e15f, ftLastWriteTime.dwLowDateTime=0x5f41d3f0, ftLastWriteTime.dwHighDateTime=0x1d5e15f, nFileSizeHigh=0x0, nFileSizeLow=0x114f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y00DAc moOje.rtf", cAlternateFileName="Y00DAC~1.RTF")) returned 0 [0070.883] FindClose (in: hFindFile=0x12cd3d8 | out: hFindFile=0x12cd3d8) returned 1 [0070.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0070.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0070.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", lpFilePart=0x0) returned 0x3a [0070.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0070.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\-7iy.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.884] GetFileType (hFile=0x354) returned 0x1 [0070.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0070.884] GetFileType (hFile=0x354) returned 0x1 [0070.884] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xb61 [0070.884] ReadFile (in: hFile=0x354, lpBuffer=0x2f4d11c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f4d11c*, lpNumberOfBytesRead=0xefebd8*=0xb61, lpOverlapped=0x0) returned 1 [0070.884] CloseHandle (hObject=0x354) returned 1 [0070.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", lpFilePart=0x0) returned 0x3a [0070.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0070.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\-7iy.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.949] GetFileType (hFile=0x354) returned 0x1 [0070.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0070.949] GetFileType (hFile=0x354) returned 0x1 [0070.949] WriteFile (in: hFile=0x354, lpBuffer=0x2f9e950*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0xefeba0, lpOverlapped=0x0 | out: lpBuffer=0x2f9e950*, lpNumberOfBytesWritten=0xefeba0*=0xb70, lpOverlapped=0x0) returned 1 [0070.950] CloseHandle (hObject=0x354) returned 1 [0070.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt", lpFilePart=0x0) returned 0x3a [0070.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt.wholocked", lpFilePart=0x0) returned 0x44 [0070.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0070.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\-7iy.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36291f90, ftCreationTime.dwHighDateTime=0x1d5e629, ftLastAccessTime.dwLowDateTime=0x21648790, ftLastAccessTime.dwHighDateTime=0x1d5f103, ftLastWriteTime.dwLowDateTime=0x4bb3ba4a, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xb70)) returned 1 [0070.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0070.951] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\-7iy.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\-7iY.ppt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\-7iy.ppt.wholocked")) returned 1 [0070.952] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", lpFilePart=0x0) returned 0x3b [0070.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0070.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\22u41.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0070.952] GetFileType (hFile=0x354) returned 0x1 [0070.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0070.952] GetFileType (hFile=0x354) returned 0x1 [0070.952] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x5644 [0070.952] ReadFile (in: hFile=0x354, lpBuffer=0x2f9fc28, nNumberOfBytesToRead=0x5644, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f9fc28*, lpNumberOfBytesRead=0xefebd8*=0x5644, lpOverlapped=0x0) returned 1 [0070.953] CloseHandle (hObject=0x354) returned 1 [0071.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", lpFilePart=0x0) returned 0x3b [0071.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\22u41.odp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.087] GetFileType (hFile=0x354) returned 0x1 [0071.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.087] GetFileType (hFile=0x354) returned 0x1 [0071.087] WriteFile (in: hFile=0x354, lpBuffer=0x2e0e014*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e0e014*, lpNumberOfBytesWritten=0xefebcc*=0x5650, lpOverlapped=0x0) returned 1 [0071.089] CloseHandle (hObject=0x354) returned 1 [0071.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp", lpFilePart=0x0) returned 0x3b [0071.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp.wholocked", lpFilePart=0x0) returned 0x45 [0071.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\22u41.odp"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c3c8ed0, ftCreationTime.dwHighDateTime=0x1d5e60f, ftLastAccessTime.dwLowDateTime=0x1a4815e0, ftLastAccessTime.dwHighDateTime=0x1d5e8c9, ftLastWriteTime.dwLowDateTime=0x4bc94634, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x5650)) returned 1 [0071.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.094] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\22u41.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\22u41.odp.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\22u41.odp.wholocked")) returned 1 [0071.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", lpFilePart=0x0) returned 0x43 [0071.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\4fpff_ciuk4v.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.095] GetFileType (hFile=0x354) returned 0x1 [0071.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.095] GetFileType (hFile=0x354) returned 0x1 [0071.096] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x587f [0071.096] ReadFile (in: hFile=0x354, lpBuffer=0x2e13a5c, nNumberOfBytesToRead=0x587f, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e13a5c*, lpNumberOfBytesRead=0xefebd8*=0x587f, lpOverlapped=0x0) returned 1 [0071.096] CloseHandle (hObject=0x354) returned 1 [0071.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", lpFilePart=0x0) returned 0x43 [0071.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\4fpff_ciuk4v.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.161] GetFileType (hFile=0x354) returned 0x1 [0071.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.161] GetFileType (hFile=0x354) returned 0x1 [0071.161] WriteFile (in: hFile=0x354, lpBuffer=0x2e7c424*, nNumberOfBytesToWrite=0x5880, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e7c424*, lpNumberOfBytesWritten=0xefebcc*=0x5880, lpOverlapped=0x0) returned 1 [0071.162] CloseHandle (hObject=0x354) returned 1 [0071.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx", lpFilePart=0x0) returned 0x43 [0071.163] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx.wholocked", lpFilePart=0x0) returned 0x4d [0071.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\4fpff_ciuk4v.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb22c920, ftCreationTime.dwHighDateTime=0x1d5e916, ftLastAccessTime.dwLowDateTime=0x41614260, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0x4bd2b8e7, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x5880)) returned 1 [0071.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.164] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\4fpff_ciuk4v.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\4FPFf_cIuK4V.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\4fpff_ciuk4v.xlsx.wholocked")) returned 1 [0071.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", lpFilePart=0x0) returned 0x3b [0071.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\jxb7.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.164] GetFileType (hFile=0x354) returned 0x1 [0071.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.164] GetFileType (hFile=0x354) returned 0x1 [0071.164] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x18896 [0071.165] ReadFile (in: hFile=0x354, lpBuffer=0x3ef1d70, nNumberOfBytesToRead=0x18896, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x3ef1d70*, lpNumberOfBytesRead=0xefebd8*=0x18896, lpOverlapped=0x0) returned 1 [0071.166] CloseHandle (hObject=0x354) returned 1 [0071.183] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", lpFilePart=0x0) returned 0x3b [0071.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\jxb7.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.239] GetFileType (hFile=0x354) returned 0x1 [0071.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.240] GetFileType (hFile=0x354) returned 0x1 [0071.240] WriteFile (in: hFile=0x354, lpBuffer=0x3f6c8c8*, nNumberOfBytesToWrite=0x188a0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3f6c8c8*, lpNumberOfBytesWritten=0xefebcc*=0x188a0, lpOverlapped=0x0) returned 1 [0071.242] CloseHandle (hObject=0x354) returned 1 [0071.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx", lpFilePart=0x0) returned 0x3b [0071.244] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx.wholocked", lpFilePart=0x0) returned 0x45 [0071.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\jxb7.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb93a020, ftCreationTime.dwHighDateTime=0x1d5ead4, ftLastAccessTime.dwLowDateTime=0x42863900, ftLastAccessTime.dwHighDateTime=0x1d5e8f2, ftLastWriteTime.dwLowDateTime=0x4bdea2ef, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x188a0)) returned 1 [0071.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.245] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\jxb7.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\JXB7.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\jxb7.pptx.wholocked")) returned 1 [0071.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", lpFilePart=0x0) returned 0x44 [0071.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\kyl-zgw-hli7dp.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.245] GetFileType (hFile=0x354) returned 0x1 [0071.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.245] GetFileType (hFile=0x354) returned 0x1 [0071.245] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x180cc [0071.246] ReadFile (in: hFile=0x354, lpBuffer=0x3f85188, nNumberOfBytesToRead=0x180cc, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x3f85188*, lpNumberOfBytesRead=0xefebd8*=0x180cc, lpOverlapped=0x0) returned 1 [0071.310] CloseHandle (hObject=0x354) returned 1 [0071.327] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", lpFilePart=0x0) returned 0x44 [0071.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.327] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\kyl-zgw-hli7dp.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.329] GetFileType (hFile=0x354) returned 0x1 [0071.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.329] GetFileType (hFile=0x354) returned 0x1 [0071.329] WriteFile (in: hFile=0x354, lpBuffer=0x3ffd5d0*, nNumberOfBytesToWrite=0x180d0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3ffd5d0*, lpNumberOfBytesWritten=0xefebcc*=0x180d0, lpOverlapped=0x0) returned 1 [0071.331] CloseHandle (hObject=0x354) returned 1 [0071.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt", lpFilePart=0x0) returned 0x44 [0071.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt.wholocked", lpFilePart=0x0) returned 0x4e [0071.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\kyl-zgw-hli7dp.odt"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50e4aa90, ftCreationTime.dwHighDateTime=0x1d5ecd5, ftLastAccessTime.dwLowDateTime=0xa7f87ea0, ftLastAccessTime.dwHighDateTime=0x1d5e498, ftLastWriteTime.dwLowDateTime=0x4becf498, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x180d0)) returned 1 [0071.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.334] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\kyl-zgw-hli7dp.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\kYL-zGW-Hli7Dp.odt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\kyl-zgw-hli7dp.odt.wholocked")) returned 1 [0071.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", lpFilePart=0x0) returned 0x40 [0071.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\l3qi_jcs-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.334] GetFileType (hFile=0x354) returned 0x1 [0071.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.335] GetFileType (hFile=0x354) returned 0x1 [0071.335] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x8a66 [0071.335] ReadFile (in: hFile=0x354, lpBuffer=0x2f1c538, nNumberOfBytesToRead=0x8a66, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f1c538*, lpNumberOfBytesRead=0xefebd8*=0x8a66, lpOverlapped=0x0) returned 1 [0071.335] CloseHandle (hObject=0x354) returned 1 [0071.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", lpFilePart=0x0) returned 0x40 [0071.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\l3qi_jcs-.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.352] GetFileType (hFile=0x354) returned 0x1 [0071.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.352] GetFileType (hFile=0x354) returned 0x1 [0071.352] WriteFile (in: hFile=0x354, lpBuffer=0x2f94754*, nNumberOfBytesToWrite=0x8a70, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f94754*, lpNumberOfBytesWritten=0xefebcc*=0x8a70, lpOverlapped=0x0) returned 1 [0071.353] CloseHandle (hObject=0x354) returned 1 [0071.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx", lpFilePart=0x0) returned 0x40 [0071.354] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx.wholocked", lpFilePart=0x0) returned 0x4a [0071.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\l3qi_jcs-.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66ad0b0, ftCreationTime.dwHighDateTime=0x1d5edae, ftLastAccessTime.dwLowDateTime=0x8da00a20, ftLastAccessTime.dwHighDateTime=0x1d5ef22, ftLastWriteTime.dwLowDateTime=0x4bef5305, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8a70)) returned 1 [0071.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.355] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\l3qi_jcs-.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\L3QI_jCS-.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\l3qi_jcs-.pptx.wholocked")) returned 1 [0071.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", lpFilePart=0x0) returned 0x47 [0071.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\t5ysjxzhzrdcor7-b.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.403] GetFileType (hFile=0x354) returned 0x1 [0071.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.403] GetFileType (hFile=0x354) returned 0x1 [0071.404] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xbaf6 [0071.404] ReadFile (in: hFile=0x354, lpBuffer=0x2f9d620, nNumberOfBytesToRead=0xbaf6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f9d620*, lpNumberOfBytesRead=0xefebd8*=0xbaf6, lpOverlapped=0x0) returned 1 [0071.404] CloseHandle (hObject=0x354) returned 1 [0071.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", lpFilePart=0x0) returned 0x47 [0071.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\t5ysjxzhzrdcor7-b.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.545] GetFileType (hFile=0x354) returned 0x1 [0071.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.545] GetFileType (hFile=0x354) returned 0x1 [0071.545] WriteFile (in: hFile=0x354, lpBuffer=0x2e24330*, nNumberOfBytesToWrite=0xbb00, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e24330*, lpNumberOfBytesWritten=0xefebcc*=0xbb00, lpOverlapped=0x0) returned 1 [0071.547] CloseHandle (hObject=0x354) returned 1 [0071.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt", lpFilePart=0x0) returned 0x47 [0071.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt.wholocked", lpFilePart=0x0) returned 0x51 [0071.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\t5ysjxzhzrdcor7-b.odt"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2453890, ftCreationTime.dwHighDateTime=0x1d5e805, ftLastAccessTime.dwLowDateTime=0xa7385e70, ftLastAccessTime.dwHighDateTime=0x1d5e391, ftLastWriteTime.dwLowDateTime=0x4c0e5438, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xbb00)) returned 1 [0071.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.549] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\t5ysjxzhzrdcor7-b.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\t5ysJXZHZRDcoR7-B.odt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\t5ysjxzhzrdcor7-b.odt.wholocked")) returned 1 [0071.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", lpFilePart=0x0) returned 0x42 [0071.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\y00dac mooje.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.550] GetFileType (hFile=0x354) returned 0x1 [0071.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.550] GetFileType (hFile=0x354) returned 0x1 [0071.550] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x114f7 [0071.550] ReadFile (in: hFile=0x354, lpBuffer=0x2e302a0, nNumberOfBytesToRead=0x114f7, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e302a0*, lpNumberOfBytesRead=0xefebd8*=0x114f7, lpOverlapped=0x0) returned 1 [0071.550] CloseHandle (hObject=0x354) returned 1 [0071.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", lpFilePart=0x0) returned 0x42 [0071.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.567] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\y00dac mooje.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.568] GetFileType (hFile=0x354) returned 0x1 [0071.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.568] GetFileType (hFile=0x354) returned 0x1 [0071.568] WriteFile (in: hFile=0x354, lpBuffer=0x2eb10fc*, nNumberOfBytesToWrite=0x11500, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eb10fc*, lpNumberOfBytesWritten=0xefebcc*=0x11500, lpOverlapped=0x0) returned 1 [0071.570] CloseHandle (hObject=0x354) returned 1 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf", lpFilePart=0x0) returned 0x42 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf.wholocked", lpFilePart=0x0) returned 0x4c [0071.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\y00dac mooje.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64318e0, ftCreationTime.dwHighDateTime=0x1d5e925, ftLastAccessTime.dwLowDateTime=0x5f41d3f0, ftLastAccessTime.dwHighDateTime=0x1d5e15f, ftLastWriteTime.dwLowDateTime=0x4c10b6bb, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x11500)) returned 1 [0071.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.572] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\y00dac mooje.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\OlVsMBM\\Y00DAc moOje.rtf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\olvsmbm\\y00dac mooje.rtf.wholocked")) returned 1 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0071.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0071.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0071.573] GetFileType (hFile=0x354) returned 0x1 [0071.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0071.573] GetFileType (hFile=0x354) returned 0x1 [0071.574] WriteFile (in: hFile=0x354, lpBuffer=0x2ec4444*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ec4444*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0071.575] CloseHandle (hObject=0x354) returned 1 [0071.575] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0071.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0071.575] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0071.576] GetFileType (hFile=0x354) returned 0x1 [0071.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0071.576] GetFileType (hFile=0x354) returned 0x1 [0071.576] WriteFile (in: hFile=0x354, lpBuffer=0x2ec6f90*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ec6f90*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0071.577] CloseHandle (hObject=0x354) returned 1 [0071.577] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0071.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0071.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0071.578] GetFileType (hFile=0x354) returned 0x1 [0071.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0071.578] GetFileType (hFile=0x354) returned 0x1 [0071.578] WriteFile (in: hFile=0x354, lpBuffer=0x2ec9adc*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ec9adc*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0071.579] CloseHandle (hObject=0x354) returned 1 [0071.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0071.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0071.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0071.580] GetFileType (hFile=0x354) returned 0x1 [0071.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0071.580] GetFileType (hFile=0x354) returned 0x1 [0071.580] WriteFile (in: hFile=0x354, lpBuffer=0x2ecc628*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ecc628*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0071.581] CloseHandle (hObject=0x354) returned 1 [0071.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0071.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m", lpFilePart=0x0) returned 0x3d [0071.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd8d8 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0f6c30, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0xb4f24ad0, ftLastAccessTime.dwHighDateTime=0x1d5ef44, ftLastWriteTime.dwLowDateTime=0xb4f24ad0, ftLastWriteTime.dwHighDateTime=0x1d5ef44, nFileSizeHigh=0x0, nFileSizeLow=0x62a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Qh_Yt3fMyE.csv", cAlternateFileName="7QH_YT~1.CSV")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c8b0e0, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0xf9d7e390, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0xf9d7e390, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0xfc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="bjXw-gDxy6t.pdf", cAlternateFileName="BJXW-G~1.PDF")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e280080, ftCreationTime.dwHighDateTime=0x1d5ea7c, ftLastAccessTime.dwLowDateTime=0xc735a2e0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0xc735a2e0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x63e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HBQHuFAZhn.rtf", cAlternateFileName="HBQHUF~1.RTF")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4feebc0, ftCreationTime.dwHighDateTime=0x1d5f01f, ftLastAccessTime.dwLowDateTime=0x49a32040, ftLastAccessTime.dwHighDateTime=0x1d5e2d0, ftLastWriteTime.dwLowDateTime=0x49a32040, ftLastWriteTime.dwHighDateTime=0x1d5e2d0, nFileSizeHigh=0x0, nFileSizeLow=0xceb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RtbaR5dpwvqhKD.odt", cAlternateFileName="RTBAR5~1.ODT")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c25a100, ftCreationTime.dwHighDateTime=0x1d5e34e, ftLastAccessTime.dwLowDateTime=0xdce2ed20, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0xdce2ed20, ftLastWriteTime.dwHighDateTime=0x1d5e64c, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="w0zi9i.ppt", cAlternateFileName="")) returned 1 [0071.582] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46ef030, ftCreationTime.dwHighDateTime=0x1d5e849, ftLastAccessTime.dwLowDateTime=0x47035010, ftLastAccessTime.dwHighDateTime=0x1d5e9cb, ftLastWriteTime.dwLowDateTime=0x47035010, ftLastWriteTime.dwHighDateTime=0x1d5e9cb, nFileSizeHigh=0x0, nFileSizeLow=0x8bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPvnJxNM71.xlsx", cAlternateFileName="WPVNJX~1.XLS")) returned 1 [0071.583] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23043d00, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x6898f420, ftLastAccessTime.dwHighDateTime=0x1d5e7bc, ftLastWriteTime.dwLowDateTime=0x6898f420, ftLastWriteTime.dwHighDateTime=0x1d5e7bc, nFileSizeHigh=0x0, nFileSizeLow=0x56b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X 0w6J6FdYDvZbzGSVR.pps", cAlternateFileName="X0W6J6~1.PPS")) returned 1 [0071.583] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e72b440, ftCreationTime.dwHighDateTime=0x1d5ecbc, ftLastAccessTime.dwLowDateTime=0xd179ecf0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0xd179ecf0, ftLastWriteTime.dwHighDateTime=0x1d5eab0, nFileSizeHigh=0x0, nFileSizeLow=0x108b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="xF n8sLBjfJbHTGHZ.ods", cAlternateFileName="XFN8SL~1.ODS")) returned 1 [0071.583] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e596b0, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xba23b690, ftLastAccessTime.dwHighDateTime=0x1d5e681, ftLastWriteTime.dwLowDateTime=0xba23b690, ftLastWriteTime.dwHighDateTime=0x1d5e681, nFileSizeHigh=0x0, nFileSizeLow=0x7a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="YaULj9zTxp8.pptx", cAlternateFileName="YAULJ9~1.PPT")) returned 1 [0071.583] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0071.583] FindClose (in: hFindFile=0x12cd8d8 | out: hFindFile=0x12cd8d8) returned 1 [0071.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0071.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0071.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0071.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m", lpFilePart=0x0) returned 0x3d [0071.583] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd5d8 [0071.583] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xded90cd0, ftCreationTime.dwHighDateTime=0x1d5ee18, ftLastAccessTime.dwLowDateTime=0x36dc8940, ftLastAccessTime.dwHighDateTime=0x1d5e6a6, ftLastWriteTime.dwLowDateTime=0x36dc8940, ftLastWriteTime.dwHighDateTime=0x1d5e6a6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0f6c30, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0xb4f24ad0, ftLastAccessTime.dwHighDateTime=0x1d5ef44, ftLastWriteTime.dwLowDateTime=0xb4f24ad0, ftLastWriteTime.dwHighDateTime=0x1d5ef44, nFileSizeHigh=0x0, nFileSizeLow=0x62a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Qh_Yt3fMyE.csv", cAlternateFileName="7QH_YT~1.CSV")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c8b0e0, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0xf9d7e390, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0xf9d7e390, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0xfc80, dwReserved0=0x0, dwReserved1=0x0, cFileName="bjXw-gDxy6t.pdf", cAlternateFileName="BJXW-G~1.PDF")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e280080, ftCreationTime.dwHighDateTime=0x1d5ea7c, ftLastAccessTime.dwLowDateTime=0xc735a2e0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0xc735a2e0, ftLastWriteTime.dwHighDateTime=0x1d5e69e, nFileSizeHigh=0x0, nFileSizeLow=0x63e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HBQHuFAZhn.rtf", cAlternateFileName="HBQHUF~1.RTF")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4feebc0, ftCreationTime.dwHighDateTime=0x1d5f01f, ftLastAccessTime.dwLowDateTime=0x49a32040, ftLastAccessTime.dwHighDateTime=0x1d5e2d0, ftLastWriteTime.dwLowDateTime=0x49a32040, ftLastWriteTime.dwHighDateTime=0x1d5e2d0, nFileSizeHigh=0x0, nFileSizeLow=0xceb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RtbaR5dpwvqhKD.odt", cAlternateFileName="RTBAR5~1.ODT")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c25a100, ftCreationTime.dwHighDateTime=0x1d5e34e, ftLastAccessTime.dwLowDateTime=0xdce2ed20, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0xdce2ed20, ftLastWriteTime.dwHighDateTime=0x1d5e64c, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="w0zi9i.ppt", cAlternateFileName="")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46ef030, ftCreationTime.dwHighDateTime=0x1d5e849, ftLastAccessTime.dwLowDateTime=0x47035010, ftLastAccessTime.dwHighDateTime=0x1d5e9cb, ftLastWriteTime.dwLowDateTime=0x47035010, ftLastWriteTime.dwHighDateTime=0x1d5e9cb, nFileSizeHigh=0x0, nFileSizeLow=0x8bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPvnJxNM71.xlsx", cAlternateFileName="WPVNJX~1.XLS")) returned 1 [0071.584] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23043d00, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x6898f420, ftLastAccessTime.dwHighDateTime=0x1d5e7bc, ftLastWriteTime.dwLowDateTime=0x6898f420, ftLastWriteTime.dwHighDateTime=0x1d5e7bc, nFileSizeHigh=0x0, nFileSizeLow=0x56b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X 0w6J6FdYDvZbzGSVR.pps", cAlternateFileName="X0W6J6~1.PPS")) returned 1 [0071.585] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e72b440, ftCreationTime.dwHighDateTime=0x1d5ecbc, ftLastAccessTime.dwLowDateTime=0xd179ecf0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0xd179ecf0, ftLastWriteTime.dwHighDateTime=0x1d5eab0, nFileSizeHigh=0x0, nFileSizeLow=0x108b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="xF n8sLBjfJbHTGHZ.ods", cAlternateFileName="XFN8SL~1.ODS")) returned 1 [0071.585] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e596b0, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xba23b690, ftLastAccessTime.dwHighDateTime=0x1d5e681, ftLastWriteTime.dwLowDateTime=0xba23b690, ftLastWriteTime.dwHighDateTime=0x1d5e681, nFileSizeHigh=0x0, nFileSizeLow=0x7a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="YaULj9zTxp8.pptx", cAlternateFileName="YAULJ9~1.PPT")) returned 1 [0071.585] FindNextFileW (in: hFindFile=0x12cd5d8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e596b0, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xba23b690, ftLastAccessTime.dwHighDateTime=0x1d5e681, ftLastWriteTime.dwLowDateTime=0xba23b690, ftLastWriteTime.dwHighDateTime=0x1d5e681, nFileSizeHigh=0x0, nFileSizeLow=0x7a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="YaULj9zTxp8.pptx", cAlternateFileName="YAULJ9~1.PPT")) returned 0 [0071.585] FindClose (in: hFindFile=0x12cd5d8 | out: hFindFile=0x12cd5d8) returned 1 [0071.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0071.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0071.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", lpFilePart=0x0) returned 0x4d [0071.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\7qh_yt3fmye.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.585] GetFileType (hFile=0x354) returned 0x1 [0071.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.586] GetFileType (hFile=0x354) returned 0x1 [0071.586] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x62a6 [0071.586] ReadFile (in: hFile=0x354, lpBuffer=0x2ed0ccc, nNumberOfBytesToRead=0x62a6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed0ccc*, lpNumberOfBytesRead=0xefebd8*=0x62a6, lpOverlapped=0x0) returned 1 [0071.586] CloseHandle (hObject=0x354) returned 1 [0071.648] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", lpFilePart=0x0) returned 0x4d [0071.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\7qh_yt3fmye.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.649] GetFileType (hFile=0x354) returned 0x1 [0071.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.649] GetFileType (hFile=0x354) returned 0x1 [0071.649] WriteFile (in: hFile=0x354, lpBuffer=0x2f3c828*, nNumberOfBytesToWrite=0x62b0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f3c828*, lpNumberOfBytesWritten=0xefebcc*=0x62b0, lpOverlapped=0x0) returned 1 [0071.650] CloseHandle (hObject=0x354) returned 1 [0071.651] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv", lpFilePart=0x0) returned 0x4d [0071.651] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv.wholocked", lpFilePart=0x0) returned 0x57 [0071.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\7qh_yt3fmye.csv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0f6c30, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0xb4f24ad0, ftLastAccessTime.dwHighDateTime=0x1d5ef44, ftLastWriteTime.dwLowDateTime=0x4c1ca22a, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x62b0)) returned 1 [0071.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.651] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\7qh_yt3fmye.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\7Qh_Yt3fMyE.csv.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\7qh_yt3fmye.csv.wholocked")) returned 1 [0071.652] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", lpFilePart=0x0) returned 0x4d [0071.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.652] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\bjxw-gdxy6t.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.652] GetFileType (hFile=0x354) returned 0x1 [0071.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.652] GetFileType (hFile=0x354) returned 0x1 [0071.653] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xfc80 [0071.653] ReadFile (in: hFile=0x354, lpBuffer=0x2f42f7c, nNumberOfBytesToRead=0xfc80, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f42f7c*, lpNumberOfBytesRead=0xefebd8*=0xfc80, lpOverlapped=0x0) returned 1 [0071.653] CloseHandle (hObject=0x354) returned 1 [0071.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", lpFilePart=0x0) returned 0x4d [0071.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.784] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\bjxw-gdxy6t.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.786] GetFileType (hFile=0x354) returned 0x1 [0071.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.786] GetFileType (hFile=0x354) returned 0x1 [0071.786] WriteFile (in: hFile=0x354, lpBuffer=0x2fbf328*, nNumberOfBytesToWrite=0xfc90, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2fbf328*, lpNumberOfBytesWritten=0xefebcc*=0xfc90, lpOverlapped=0x0) returned 1 [0071.787] CloseHandle (hObject=0x354) returned 1 [0071.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf", lpFilePart=0x0) returned 0x4d [0071.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf.wholocked", lpFilePart=0x0) returned 0x57 [0071.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\bjxw-gdxy6t.pdf"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c8b0e0, ftCreationTime.dwHighDateTime=0x1d5ec0c, ftLastAccessTime.dwLowDateTime=0xf9d7e390, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x4c321a54, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xfc90)) returned 1 [0071.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.790] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\bjxw-gdxy6t.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\bjXw-gDxy6t.pdf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\bjxw-gdxy6t.pdf.wholocked")) returned 1 [0071.790] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", lpFilePart=0x0) returned 0x4c [0071.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.790] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\hbqhufazhn.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.790] GetFileType (hFile=0x354) returned 0x1 [0071.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.790] GetFileType (hFile=0x354) returned 0x1 [0071.790] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x63e6 [0071.791] ReadFile (in: hFile=0x354, lpBuffer=0x2fcf45c, nNumberOfBytesToRead=0x63e6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2fcf45c*, lpNumberOfBytesRead=0xefebd8*=0x63e6, lpOverlapped=0x0) returned 1 [0071.791] CloseHandle (hObject=0x354) returned 1 [0071.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", lpFilePart=0x0) returned 0x4c [0071.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\hbqhufazhn.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.870] GetFileType (hFile=0x354) returned 0x1 [0071.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.870] GetFileType (hFile=0x354) returned 0x1 [0071.870] WriteFile (in: hFile=0x354, lpBuffer=0x2e42a0c*, nNumberOfBytesToWrite=0x63f0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e42a0c*, lpNumberOfBytesWritten=0xefebcc*=0x63f0, lpOverlapped=0x0) returned 1 [0071.873] CloseHandle (hObject=0x354) returned 1 [0071.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf", lpFilePart=0x0) returned 0x4c [0071.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf.wholocked", lpFilePart=0x0) returned 0x56 [0071.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\hbqhufazhn.rtf"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e280080, ftCreationTime.dwHighDateTime=0x1d5ea7c, ftLastAccessTime.dwLowDateTime=0xc735a2e0, ftLastAccessTime.dwHighDateTime=0x1d5e69e, ftLastWriteTime.dwLowDateTime=0x4c406338, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x63f0)) returned 1 [0071.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.875] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\hbqhufazhn.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\HBQHuFAZhn.rtf.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\hbqhufazhn.rtf.wholocked")) returned 1 [0071.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", lpFilePart=0x0) returned 0x50 [0071.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\rtbar5dpwvqhkd.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.876] GetFileType (hFile=0x354) returned 0x1 [0071.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.876] GetFileType (hFile=0x354) returned 0x1 [0071.876] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xceb6 [0071.876] ReadFile (in: hFile=0x354, lpBuffer=0x2e492b0, nNumberOfBytesToRead=0xceb6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e492b0*, lpNumberOfBytesRead=0xefebd8*=0xceb6, lpOverlapped=0x0) returned 1 [0071.877] CloseHandle (hObject=0x354) returned 1 [0071.892] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", lpFilePart=0x0) returned 0x50 [0071.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.892] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\rtbar5dpwvqhkd.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.893] GetFileType (hFile=0x354) returned 0x1 [0071.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.894] GetFileType (hFile=0x354) returned 0x1 [0071.894] WriteFile (in: hFile=0x354, lpBuffer=0x2ebce4c*, nNumberOfBytesToWrite=0xcec0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ebce4c*, lpNumberOfBytesWritten=0xefebcc*=0xcec0, lpOverlapped=0x0) returned 1 [0071.895] CloseHandle (hObject=0x354) returned 1 [0071.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt", lpFilePart=0x0) returned 0x50 [0071.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt.wholocked", lpFilePart=0x0) returned 0x5a [0071.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\rtbar5dpwvqhkd.odt"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4feebc0, ftCreationTime.dwHighDateTime=0x1d5f01f, ftLastAccessTime.dwLowDateTime=0x49a32040, ftLastAccessTime.dwHighDateTime=0x1d5e2d0, ftLastWriteTime.dwLowDateTime=0x4c42c5bb, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xcec0)) returned 1 [0071.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.897] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\rtbar5dpwvqhkd.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\RtbaR5dpwvqhKD.odt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\rtbar5dpwvqhkd.odt.wholocked")) returned 1 [0071.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", lpFilePart=0x0) returned 0x48 [0071.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\w0zi9i.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.898] GetFileType (hFile=0x354) returned 0x1 [0071.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.898] GetFileType (hFile=0x354) returned 0x1 [0071.898] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xe0a8 [0071.898] ReadFile (in: hFile=0x354, lpBuffer=0x2eca1c8, nNumberOfBytesToRead=0xe0a8, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2eca1c8*, lpNumberOfBytesRead=0xefebd8*=0xe0a8, lpOverlapped=0x0) returned 1 [0071.898] CloseHandle (hObject=0x354) returned 1 [0071.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", lpFilePart=0x0) returned 0x48 [0071.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\w0zi9i.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.915] GetFileType (hFile=0x354) returned 0x1 [0071.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.916] GetFileType (hFile=0x354) returned 0x1 [0071.916] WriteFile (in: hFile=0x354, lpBuffer=0x2f411d4*, nNumberOfBytesToWrite=0xe0b0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f411d4*, lpNumberOfBytesWritten=0xefebcc*=0xe0b0, lpOverlapped=0x0) returned 1 [0071.917] CloseHandle (hObject=0x354) returned 1 [0071.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt", lpFilePart=0x0) returned 0x48 [0071.977] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt.wholocked", lpFilePart=0x0) returned 0x52 [0071.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\w0zi9i.ppt"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c25a100, ftCreationTime.dwHighDateTime=0x1d5e34e, ftLastAccessTime.dwLowDateTime=0xdce2ed20, ftLastAccessTime.dwHighDateTime=0x1d5e64c, ftLastWriteTime.dwLowDateTime=0x4c4eb338, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b0)) returned 1 [0071.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.977] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\w0zi9i.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\w0zi9i.ppt.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\w0zi9i.ppt.wholocked")) returned 1 [0071.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", lpFilePart=0x0) returned 0x4d [0071.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0071.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\wpvnjxnm71.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.978] GetFileType (hFile=0x354) returned 0x1 [0071.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0071.978] GetFileType (hFile=0x354) returned 0x1 [0071.978] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x8bb0 [0071.978] ReadFile (in: hFile=0x354, lpBuffer=0x2f4f700, nNumberOfBytesToRead=0x8bb0, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f4f700*, lpNumberOfBytesRead=0xefebd8*=0x8bb0, lpOverlapped=0x0) returned 1 [0071.978] CloseHandle (hObject=0x354) returned 1 [0071.995] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", lpFilePart=0x0) returned 0x4d [0071.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0071.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\wpvnjxnm71.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.996] GetFileType (hFile=0x354) returned 0x1 [0071.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0071.997] GetFileType (hFile=0x354) returned 0x1 [0071.997] WriteFile (in: hFile=0x354, lpBuffer=0x2fc7fa8*, nNumberOfBytesToWrite=0x8bc0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2fc7fa8*, lpNumberOfBytesWritten=0xefebcc*=0x8bc0, lpOverlapped=0x0) returned 1 [0071.998] CloseHandle (hObject=0x354) returned 1 [0071.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx", lpFilePart=0x0) returned 0x4d [0071.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx.wholocked", lpFilePart=0x0) returned 0x57 [0071.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0071.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\wpvnjxnm71.xlsx"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46ef030, ftCreationTime.dwHighDateTime=0x1d5e849, ftLastAccessTime.dwLowDateTime=0x47035010, ftLastAccessTime.dwHighDateTime=0x1d5e9cb, ftLastWriteTime.dwLowDateTime=0x4c5377f8, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8bc0)) returned 1 [0071.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0071.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\wpvnjxnm71.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\WPvnJxNM71.xlsx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\wpvnjxnm71.xlsx.wholocked")) returned 1 [0072.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", lpFilePart=0x0) returned 0x53 [0072.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0072.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\xf n8slbjfjbhtghz.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.000] GetFileType (hFile=0x354) returned 0x1 [0072.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0072.000] GetFileType (hFile=0x354) returned 0x1 [0072.000] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x108b4 [0072.000] ReadFile (in: hFile=0x354, lpBuffer=0x2fd103c, nNumberOfBytesToRead=0x108b4, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2fd103c*, lpNumberOfBytesRead=0xefebd8*=0x108b4, lpOverlapped=0x0) returned 1 [0072.001] CloseHandle (hObject=0x354) returned 1 [0072.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", lpFilePart=0x0) returned 0x53 [0072.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0072.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\xf n8slbjfjbhtghz.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.067] GetFileType (hFile=0x354) returned 0x1 [0072.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0072.067] GetFileType (hFile=0x354) returned 0x1 [0072.067] WriteFile (in: hFile=0x354, lpBuffer=0x2e6cf74*, nNumberOfBytesToWrite=0x108c0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e6cf74*, lpNumberOfBytesWritten=0xefebcc*=0x108c0, lpOverlapped=0x0) returned 1 [0072.069] CloseHandle (hObject=0x354) returned 1 [0072.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods", lpFilePart=0x0) returned 0x53 [0072.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods.wholocked", lpFilePart=0x0) returned 0x5d [0072.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0072.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\xf n8slbjfjbhtghz.ods"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e72b440, ftCreationTime.dwHighDateTime=0x1d5ecbc, ftLastAccessTime.dwLowDateTime=0xd179ecf0, ftLastAccessTime.dwHighDateTime=0x1d5eab0, ftLastWriteTime.dwLowDateTime=0x4c5d00fa, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x108c0)) returned 1 [0072.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0072.071] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\xf n8slbjfjbhtghz.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\xF n8sLBjfJbHTGHZ.ods.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\xf n8slbjfjbhtghz.ods.wholocked")) returned 1 [0072.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", lpFilePart=0x0) returned 0x4e [0072.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0072.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\yaulj9ztxp8.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.072] GetFileType (hFile=0x354) returned 0x1 [0072.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0072.072] GetFileType (hFile=0x354) returned 0x1 [0072.072] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x7a0d [0072.072] ReadFile (in: hFile=0x354, lpBuffer=0x2e7dd1c, nNumberOfBytesToRead=0x7a0d, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e7dd1c*, lpNumberOfBytesRead=0xefebd8*=0x7a0d, lpOverlapped=0x0) returned 1 [0072.072] CloseHandle (hObject=0x354) returned 1 [0072.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", lpFilePart=0x0) returned 0x4e [0072.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0072.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\yaulj9ztxp8.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.089] GetFileType (hFile=0x354) returned 0x1 [0072.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0072.089] GetFileType (hFile=0x354) returned 0x1 [0072.089] WriteFile (in: hFile=0x354, lpBuffer=0x2ef0eb4*, nNumberOfBytesToWrite=0x7a10, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ef0eb4*, lpNumberOfBytesWritten=0xefebcc*=0x7a10, lpOverlapped=0x0) returned 1 [0072.091] CloseHandle (hObject=0x354) returned 1 [0072.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx", lpFilePart=0x0) returned 0x4e [0072.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx.wholocked", lpFilePart=0x0) returned 0x58 [0072.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0072.092] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\yaulj9ztxp8.pptx"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0e596b0, ftCreationTime.dwHighDateTime=0x1d5eebd, ftLastAccessTime.dwLowDateTime=0xba23b690, ftLastAccessTime.dwHighDateTime=0x1d5e681, ftLastWriteTime.dwLowDateTime=0x4c61c5ea, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x7a10)) returned 1 [0072.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0072.092] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\yaulj9ztxp8.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nTj7fDIis5pb3Oa\\T1nlgU2Emv-mTJhJN7m\\YaULj9zTxp8.pptx.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\ntj7fdiis5pb3oa\\t1nlgu2emv-mtjhjn7m\\yaulj9ztxp8.pptx.wholocked")) returned 1 [0072.092] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0072.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0072.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.093] GetFileType (hFile=0x354) returned 0x1 [0072.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0072.093] GetFileType (hFile=0x354) returned 0x1 [0072.094] WriteFile (in: hFile=0x354, lpBuffer=0x2efa76c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2efa76c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0072.094] CloseHandle (hObject=0x354) returned 1 [0072.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0072.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.095] GetFileType (hFile=0x354) returned 0x1 [0072.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0072.096] GetFileType (hFile=0x354) returned 0x1 [0072.096] WriteFile (in: hFile=0x354, lpBuffer=0x2efd2b8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2efd2b8*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0072.097] CloseHandle (hObject=0x354) returned 1 [0072.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0072.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.098] GetFileType (hFile=0x354) returned 0x1 [0072.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0072.098] GetFileType (hFile=0x354) returned 0x1 [0072.098] WriteFile (in: hFile=0x354, lpBuffer=0x2effe04*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2effe04*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0072.099] CloseHandle (hObject=0x354) returned 1 [0072.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0072.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0072.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.100] GetFileType (hFile=0x354) returned 0x1 [0072.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0072.100] GetFileType (hFile=0x354) returned 0x1 [0072.100] WriteFile (in: hFile=0x354, lpBuffer=0x2f02950*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f02950*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0072.101] CloseHandle (hObject=0x354) returned 1 [0072.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0072.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.101] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.102] GetFileType (hFile=0x354) returned 0x1 [0072.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.102] GetFileType (hFile=0x354) returned 0x1 [0072.102] WriteFile (in: hFile=0x354, lpBuffer=0x2f05494*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f05494*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.103] CloseHandle (hObject=0x354) returned 1 [0072.103] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.104] GetFileType (hFile=0x354) returned 0x1 [0072.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.104] GetFileType (hFile=0x354) returned 0x1 [0072.104] WriteFile (in: hFile=0x354, lpBuffer=0x2f07fe0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f07fe0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.105] CloseHandle (hObject=0x354) returned 1 [0072.105] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.153] GetFileType (hFile=0x354) returned 0x1 [0072.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.153] GetFileType (hFile=0x354) returned 0x1 [0072.154] WriteFile (in: hFile=0x354, lpBuffer=0x2f0ab2c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0ab2c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.154] CloseHandle (hObject=0x354) returned 1 [0072.154] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0072.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.155] GetFileType (hFile=0x354) returned 0x1 [0072.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.155] GetFileType (hFile=0x354) returned 0x1 [0072.156] WriteFile (in: hFile=0x354, lpBuffer=0x2f0d678*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0d678*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.156] CloseHandle (hObject=0x354) returned 1 [0072.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0072.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0072.157] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd598 [0072.158] FindNextFileW (in: hFindFile=0x12cd598, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.158] FindNextFileW (in: hFindFile=0x12cd598, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0072.158] FindNextFileW (in: hFindFile=0x12cd598, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.158] FindClose (in: hFindFile=0x12cd598 | out: hFindFile=0x12cd598) returned 1 [0072.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0072.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0072.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0072.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0072.158] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd8d8 [0072.159] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.159] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0072.159] FindNextFileW (in: hFindFile=0x12cd8d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0072.159] FindClose (in: hFindFile=0x12cd8d8 | out: hFindFile=0x12cd8d8) returned 1 [0072.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0072.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0072.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38 [0072.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0072.159] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.159] GetFileType (hFile=0x354) returned 0x1 [0072.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0072.160] GetFileType (hFile=0x354) returned 0x1 [0072.160] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x42400 [0072.181] ReadFile (in: hFile=0x354, lpBuffer=0x3db1e68, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x3db1e68*, lpNumberOfBytesRead=0xefec60*=0x42400, lpOverlapped=0x0) returned 1 [0072.300] CloseHandle (hObject=0x354) returned 1 [0072.421] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38 [0072.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0072.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.474] GetFileType (hFile=0x354) returned 0x1 [0072.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0072.474] GetFileType (hFile=0x354) returned 0x1 [0072.474] WriteFile (in: hFile=0x354, lpBuffer=0x3efd2e8*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x3efd2e8*, lpNumberOfBytesWritten=0xefec54*=0x42410, lpOverlapped=0x0) returned 1 [0072.480] CloseHandle (hObject=0x354) returned 1 [0072.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpFilePart=0x0) returned 0x38 [0072.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.wholocked", lpFilePart=0x0) returned 0x42 [0072.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0072.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x4c9c349a, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x42410)) returned 1 [0072.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0072.487] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.wholocked" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.wholocked")) returned 1 [0072.489] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0072.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.489] GetFileType (hFile=0x354) returned 0x1 [0072.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.490] GetFileType (hFile=0x354) returned 0x1 [0072.490] WriteFile (in: hFile=0x354, lpBuffer=0x2e1cf28*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e1cf28*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.491] CloseHandle (hObject=0x354) returned 1 [0072.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.492] GetFileType (hFile=0x354) returned 0x1 [0072.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.492] GetFileType (hFile=0x354) returned 0x1 [0072.492] WriteFile (in: hFile=0x354, lpBuffer=0x2e1fa74*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e1fa74*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.493] CloseHandle (hObject=0x354) returned 1 [0072.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0072.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.494] GetFileType (hFile=0x354) returned 0x1 [0072.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.494] GetFileType (hFile=0x354) returned 0x1 [0072.494] WriteFile (in: hFile=0x354, lpBuffer=0x2e225c0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e225c0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.495] CloseHandle (hObject=0x354) returned 1 [0072.495] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0072.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0072.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.496] GetFileType (hFile=0x354) returned 0x1 [0072.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0072.496] GetFileType (hFile=0x354) returned 0x1 [0072.496] WriteFile (in: hFile=0x354, lpBuffer=0x2e2510c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e2510c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0072.497] CloseHandle (hObject=0x354) returned 1 [0072.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0072.498] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\", lpFilePart=0x0) returned 0x19 [0072.498] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe55db779, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x4b165cf6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x125f5e8 [0072.498] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe55db779, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x4b165cf6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.498] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bac80e0, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x8931bda0, ftLastAccessTime.dwHighDateTime=0x1d5ed2c, ftLastWriteTime.dwLowDateTime=0x8931bda0, ftLastWriteTime.dwHighDateTime=0x1d5ed2c, nFileSizeHigh=0x0, nFileSizeLow=0x1204f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BNGJkFV8M.jpg", cAlternateFileName="1BNGJK~1.JPG")) returned 1 [0072.498] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9159cab0, ftCreationTime.dwHighDateTime=0x1d5ea28, ftLastAccessTime.dwLowDateTime=0x4635ac20, ftLastAccessTime.dwHighDateTime=0x1d5e7e4, ftLastWriteTime.dwLowDateTime=0x4635ac20, ftLastWriteTime.dwHighDateTime=0x1d5e7e4, nFileSizeHigh=0x0, nFileSizeLow=0x51a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4zOPjK2MNYj.png", cAlternateFileName="4ZOPJK~1.PNG")) returned 1 [0072.498] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab07bf60, ftCreationTime.dwHighDateTime=0x1d5e525, ftLastAccessTime.dwLowDateTime=0x62dbf3d0, ftLastAccessTime.dwHighDateTime=0x1d5ed56, ftLastWriteTime.dwLowDateTime=0x62dbf3d0, ftLastWriteTime.dwHighDateTime=0x1d5ed56, nFileSizeHigh=0x0, nFileSizeLow=0x14e52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5WHKno_.png", cAlternateFileName="")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ac3a0, ftCreationTime.dwHighDateTime=0x1d5eeb6, ftLastAccessTime.dwLowDateTime=0x930a1d30, ftLastAccessTime.dwHighDateTime=0x1d5ebb1, ftLastWriteTime.dwLowDateTime=0x930a1d30, ftLastWriteTime.dwHighDateTime=0x1d5ebb1, nFileSizeHigh=0x0, nFileSizeLow=0x100d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7GhD4mePf2L-_-pf.png", cAlternateFileName="7GHD4M~1.PNG")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6938b150, ftCreationTime.dwHighDateTime=0x1d5efe5, ftLastAccessTime.dwLowDateTime=0x2b4476c0, ftLastAccessTime.dwHighDateTime=0x1d5ea2e, ftLastWriteTime.dwLowDateTime=0x2b4476c0, ftLastWriteTime.dwHighDateTime=0x1d5ea2e, nFileSizeHigh=0x0, nFileSizeLow=0xe5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bHuAFqoNlkrSOw-I2-j.gif", cAlternateFileName="BHUAFQ~1.GIF")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec337880, ftCreationTime.dwHighDateTime=0x1d5e0bb, ftLastAccessTime.dwLowDateTime=0x28ec90b0, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x28ec90b0, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x266d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVL9.gif", cAlternateFileName="")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce8137e0, ftCreationTime.dwHighDateTime=0x1d5eef9, ftLastAccessTime.dwLowDateTime=0x2f25ac10, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0x2f25ac10, ftLastWriteTime.dwHighDateTime=0x1d5edb1, nFileSizeHigh=0x0, nFileSizeLow=0xcf65, dwReserved0=0x0, dwReserved1=0x0, cFileName="eUdxT35.gif", cAlternateFileName="")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60d2570, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x28810c80, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0x28810c80, ftLastWriteTime.dwHighDateTime=0x1d5ee09, nFileSizeHigh=0x0, nFileSizeLow=0x14cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="fELj1ZQq4t1nZ44ZOC.jpg", cAlternateFileName="FELJ1Z~1.JPG")) returned 1 [0072.499] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c0dc50, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x47dbceb0, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x47dbceb0, ftLastWriteTime.dwHighDateTime=0x1d5e118, nFileSizeHigh=0x0, nFileSizeLow=0xa357, dwReserved0=0x0, dwReserved1=0x0, cFileName="hphZYKYvjtgQaKS0YoY.gif", cAlternateFileName="HPHZYK~1.GIF")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f765d0, ftCreationTime.dwHighDateTime=0x1d5e9ed, ftLastAccessTime.dwLowDateTime=0x3093b350, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x3093b350, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x460d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogqec_cm3apNW.jpg", cAlternateFileName="OGQEC_~1.JPG")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b165cf6, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x4b165cf6, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4c9e9851, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="READ_ME_Heyyyyyyy.txt", cAlternateFileName="READ_M~1.TXT")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rO35ytMPEV-Qo1Je", cAlternateFileName="RO35YT~1")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e1e320, ftCreationTime.dwHighDateTime=0x1d5e184, ftLastAccessTime.dwLowDateTime=0x4e182290, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0x4e182290, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x135c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="uQypTEaAJX1h.gif", cAlternateFileName="UQYPTE~1.GIF")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903ef240, ftCreationTime.dwHighDateTime=0x1d5f072, ftLastAccessTime.dwLowDateTime=0x3894c380, ftLastAccessTime.dwHighDateTime=0x1d5e749, ftLastWriteTime.dwLowDateTime=0x3894c380, ftLastWriteTime.dwHighDateTime=0x1d5e749, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eQIuLOj1Mv3B62HBQ.bmp", cAlternateFileName="Z5EQIU~1.BMP")) returned 1 [0072.500] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.500] FindClose (in: hFindFile=0x125f5e8 | out: hFindFile=0x125f5e8) returned 1 [0072.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0072.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0072.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0072.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\", lpFilePart=0x0) returned 0x19 [0072.501] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4b165cf6, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4b165cf6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x125f5e8 [0072.501] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4b165cf6, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4b165cf6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.501] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bac80e0, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x8931bda0, ftLastAccessTime.dwHighDateTime=0x1d5ed2c, ftLastWriteTime.dwLowDateTime=0x8931bda0, ftLastWriteTime.dwHighDateTime=0x1d5ed2c, nFileSizeHigh=0x0, nFileSizeLow=0x1204f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BNGJkFV8M.jpg", cAlternateFileName="1BNGJK~1.JPG")) returned 1 [0072.501] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9159cab0, ftCreationTime.dwHighDateTime=0x1d5ea28, ftLastAccessTime.dwLowDateTime=0x4635ac20, ftLastAccessTime.dwHighDateTime=0x1d5e7e4, ftLastWriteTime.dwLowDateTime=0x4635ac20, ftLastWriteTime.dwHighDateTime=0x1d5e7e4, nFileSizeHigh=0x0, nFileSizeLow=0x51a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4zOPjK2MNYj.png", cAlternateFileName="4ZOPJK~1.PNG")) returned 1 [0072.501] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab07bf60, ftCreationTime.dwHighDateTime=0x1d5e525, ftLastAccessTime.dwLowDateTime=0x62dbf3d0, ftLastAccessTime.dwHighDateTime=0x1d5ed56, ftLastWriteTime.dwLowDateTime=0x62dbf3d0, ftLastWriteTime.dwHighDateTime=0x1d5ed56, nFileSizeHigh=0x0, nFileSizeLow=0x14e52, dwReserved0=0x0, dwReserved1=0x0, cFileName="5WHKno_.png", cAlternateFileName="")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ac3a0, ftCreationTime.dwHighDateTime=0x1d5eeb6, ftLastAccessTime.dwLowDateTime=0x930a1d30, ftLastAccessTime.dwHighDateTime=0x1d5ebb1, ftLastWriteTime.dwLowDateTime=0x930a1d30, ftLastWriteTime.dwHighDateTime=0x1d5ebb1, nFileSizeHigh=0x0, nFileSizeLow=0x100d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7GhD4mePf2L-_-pf.png", cAlternateFileName="7GHD4M~1.PNG")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6938b150, ftCreationTime.dwHighDateTime=0x1d5efe5, ftLastAccessTime.dwLowDateTime=0x2b4476c0, ftLastAccessTime.dwHighDateTime=0x1d5ea2e, ftLastWriteTime.dwLowDateTime=0x2b4476c0, ftLastWriteTime.dwHighDateTime=0x1d5ea2e, nFileSizeHigh=0x0, nFileSizeLow=0xe5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bHuAFqoNlkrSOw-I2-j.gif", cAlternateFileName="BHUAFQ~1.GIF")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec337880, ftCreationTime.dwHighDateTime=0x1d5e0bb, ftLastAccessTime.dwLowDateTime=0x28ec90b0, ftLastAccessTime.dwHighDateTime=0x1d5e0f1, ftLastWriteTime.dwLowDateTime=0x28ec90b0, ftLastWriteTime.dwHighDateTime=0x1d5e0f1, nFileSizeHigh=0x0, nFileSizeLow=0x266d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bVL9.gif", cAlternateFileName="")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce8137e0, ftCreationTime.dwHighDateTime=0x1d5eef9, ftLastAccessTime.dwLowDateTime=0x2f25ac10, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0x2f25ac10, ftLastWriteTime.dwHighDateTime=0x1d5edb1, nFileSizeHigh=0x0, nFileSizeLow=0xcf65, dwReserved0=0x0, dwReserved1=0x0, cFileName="eUdxT35.gif", cAlternateFileName="")) returned 1 [0072.502] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60d2570, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x28810c80, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0x28810c80, ftLastWriteTime.dwHighDateTime=0x1d5ee09, nFileSizeHigh=0x0, nFileSizeLow=0x14cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="fELj1ZQq4t1nZ44ZOC.jpg", cAlternateFileName="FELJ1Z~1.JPG")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c0dc50, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x47dbceb0, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x47dbceb0, ftLastWriteTime.dwHighDateTime=0x1d5e118, nFileSizeHigh=0x0, nFileSizeLow=0xa357, dwReserved0=0x0, dwReserved1=0x0, cFileName="hphZYKYvjtgQaKS0YoY.gif", cAlternateFileName="HPHZYK~1.GIF")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f765d0, ftCreationTime.dwHighDateTime=0x1d5e9ed, ftLastAccessTime.dwLowDateTime=0x3093b350, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x3093b350, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x460d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogqec_cm3apNW.jpg", cAlternateFileName="OGQEC_~1.JPG")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b165cf6, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x4b165cf6, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4c9e9851, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="READ_ME_Heyyyyyyy.txt", cAlternateFileName="READ_M~1.TXT")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rO35ytMPEV-Qo1Je", cAlternateFileName="RO35YT~1")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78e1e320, ftCreationTime.dwHighDateTime=0x1d5e184, ftLastAccessTime.dwLowDateTime=0x4e182290, ftLastAccessTime.dwHighDateTime=0x1d5e67e, ftLastWriteTime.dwLowDateTime=0x4e182290, ftLastWriteTime.dwHighDateTime=0x1d5e67e, nFileSizeHigh=0x0, nFileSizeLow=0x135c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="uQypTEaAJX1h.gif", cAlternateFileName="UQYPTE~1.GIF")) returned 1 [0072.503] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903ef240, ftCreationTime.dwHighDateTime=0x1d5f072, ftLastAccessTime.dwLowDateTime=0x3894c380, ftLastAccessTime.dwHighDateTime=0x1d5e749, ftLastWriteTime.dwLowDateTime=0x3894c380, ftLastWriteTime.dwHighDateTime=0x1d5e749, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eQIuLOj1Mv3B62HBQ.bmp", cAlternateFileName="Z5EQIU~1.BMP")) returned 1 [0072.504] FindNextFileW (in: hFindFile=0x125f5e8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903ef240, ftCreationTime.dwHighDateTime=0x1d5f072, ftLastAccessTime.dwLowDateTime=0x3894c380, ftLastAccessTime.dwHighDateTime=0x1d5e749, ftLastWriteTime.dwLowDateTime=0x3894c380, ftLastWriteTime.dwHighDateTime=0x1d5e749, nFileSizeHigh=0x0, nFileSizeLow=0x2d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z5eQIuLOj1Mv3B62HBQ.bmp", cAlternateFileName="Z5EQIU~1.BMP")) returned 0 [0072.504] FindClose (in: hFindFile=0x125f5e8 | out: hFindFile=0x125f5e8) returned 1 [0072.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0072.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0072.504] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", lpFilePart=0x0) returned 0x27 [0072.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0072.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\1bngjkfv8m.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.504] GetFileType (hFile=0x354) returned 0x1 [0072.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0072.504] GetFileType (hFile=0x354) returned 0x1 [0072.504] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x1204f [0072.505] ReadFile (in: hFile=0x354, lpBuffer=0x2e29aac, nNumberOfBytesToRead=0x1204f, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e29aac*, lpNumberOfBytesRead=0xefece8*=0x1204f, lpOverlapped=0x0) returned 1 [0072.505] CloseHandle (hObject=0x354) returned 1 [0072.600] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", lpFilePart=0x0) returned 0x27 [0072.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0072.600] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\1bngjkfv8m.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.602] GetFileType (hFile=0x354) returned 0x1 [0072.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0072.602] GetFileType (hFile=0x354) returned 0x1 [0072.602] WriteFile (in: hFile=0x354, lpBuffer=0x2eac99c*, nNumberOfBytesToWrite=0x12050, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2eac99c*, lpNumberOfBytesWritten=0xefecdc*=0x12050, lpOverlapped=0x0) returned 1 [0072.604] CloseHandle (hObject=0x354) returned 1 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg", lpFilePart=0x0) returned 0x27 [0072.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg.wholocked", lpFilePart=0x0) returned 0x31 [0072.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0072.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\1bngjkfv8m.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bac80e0, ftCreationTime.dwHighDateTime=0x1d5e211, ftLastAccessTime.dwLowDateTime=0x8931bda0, ftLastAccessTime.dwHighDateTime=0x1d5ed2c, ftLastWriteTime.dwLowDateTime=0x4caf479f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x12050)) returned 1 [0072.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0072.607] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\1bngjkfv8m.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\1BNGJkFV8M.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\1bngjkfv8m.jpg.wholocked")) returned 1 [0072.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", lpFilePart=0x0) returned 0x28 [0072.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0072.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4zopjk2mnyj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.608] GetFileType (hFile=0x354) returned 0x1 [0072.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0072.608] GetFileType (hFile=0x354) returned 0x1 [0072.608] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x51a7 [0072.608] ReadFile (in: hFile=0x354, lpBuffer=0x2ebed18, nNumberOfBytesToRead=0x51a7, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ebed18*, lpNumberOfBytesRead=0xefece8*=0x51a7, lpOverlapped=0x0) returned 1 [0072.608] CloseHandle (hObject=0x354) returned 1 [0072.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", lpFilePart=0x0) returned 0x28 [0072.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0072.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4zopjk2mnyj.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.716] GetFileType (hFile=0x354) returned 0x1 [0072.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0072.716] GetFileType (hFile=0x354) returned 0x1 [0072.717] WriteFile (in: hFile=0x354, lpBuffer=0x2f25374*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f25374*, lpNumberOfBytesWritten=0xefecdc*=0x51b0, lpOverlapped=0x0) returned 1 [0072.718] CloseHandle (hObject=0x354) returned 1 [0072.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png", lpFilePart=0x0) returned 0x28 [0072.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png.wholocked", lpFilePart=0x0) returned 0x32 [0072.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0072.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4zopjk2mnyj.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9159cab0, ftCreationTime.dwHighDateTime=0x1d5ea28, ftLastAccessTime.dwLowDateTime=0x4635ac20, ftLastAccessTime.dwHighDateTime=0x1d5e7e4, ftLastWriteTime.dwLowDateTime=0x4cbff9bd, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x51b0)) returned 1 [0072.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0072.720] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4zopjk2mnyj.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4zOPjK2MNYj.png.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\4zopjk2mnyj.png.wholocked")) returned 1 [0072.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", lpFilePart=0x0) returned 0x24 [0072.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0072.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5whkno_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.721] GetFileType (hFile=0x354) returned 0x1 [0072.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0072.721] GetFileType (hFile=0x354) returned 0x1 [0072.721] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x14e52 [0072.721] ReadFile (in: hFile=0x354, lpBuffer=0x3f637b8, nNumberOfBytesToRead=0x14e52, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3f637b8*, lpNumberOfBytesRead=0xefece8*=0x14e52, lpOverlapped=0x0) returned 1 [0072.736] CloseHandle (hObject=0x354) returned 1 [0072.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", lpFilePart=0x0) returned 0x24 [0072.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0072.808] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5whkno_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.809] GetFileType (hFile=0x354) returned 0x1 [0072.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0072.809] GetFileType (hFile=0x354) returned 0x1 [0072.809] WriteFile (in: hFile=0x354, lpBuffer=0x3fcbfc8*, nNumberOfBytesToWrite=0x14e60, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3fcbfc8*, lpNumberOfBytesWritten=0xefecdc*=0x14e60, lpOverlapped=0x0) returned 1 [0072.811] CloseHandle (hObject=0x354) returned 1 [0072.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png", lpFilePart=0x0) returned 0x24 [0072.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png.wholocked", lpFilePart=0x0) returned 0x2e [0072.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0072.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5whkno_.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab07bf60, ftCreationTime.dwHighDateTime=0x1d5e525, ftLastAccessTime.dwLowDateTime=0x62dbf3d0, ftLastAccessTime.dwHighDateTime=0x1d5ed56, ftLastWriteTime.dwLowDateTime=0x4cce4675, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x14e60)) returned 1 [0072.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0072.814] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5whkno_.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5WHKno_.png.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\5whkno_.png.wholocked")) returned 1 [0072.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", lpFilePart=0x0) returned 0x2d [0072.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0072.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ghd4mepf2l-_-pf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.815] GetFileType (hFile=0x354) returned 0x1 [0072.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0072.815] GetFileType (hFile=0x354) returned 0x1 [0072.815] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x100d9 [0072.815] ReadFile (in: hFile=0x354, lpBuffer=0x2f77974, nNumberOfBytesToRead=0x100d9, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f77974*, lpNumberOfBytesRead=0xefece8*=0x100d9, lpOverlapped=0x0) returned 1 [0072.816] CloseHandle (hObject=0x354) returned 1 [0073.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", lpFilePart=0x0) returned 0x2d [0073.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0073.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ghd4mepf2l-_-pf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.127] GetFileType (hFile=0x354) returned 0x1 [0073.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0073.127] GetFileType (hFile=0x354) returned 0x1 [0073.127] WriteFile (in: hFile=0x354, lpBuffer=0x2e03b34*, nNumberOfBytesToWrite=0x100e0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e03b34*, lpNumberOfBytesWritten=0xefecdc*=0x100e0, lpOverlapped=0x0) returned 1 [0073.129] CloseHandle (hObject=0x354) returned 1 [0073.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png", lpFilePart=0x0) returned 0x2d [0073.131] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png.wholocked", lpFilePart=0x0) returned 0x37 [0073.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0073.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ghd4mepf2l-_-pf.png"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376ac3a0, ftCreationTime.dwHighDateTime=0x1d5eeb6, ftLastAccessTime.dwLowDateTime=0x930a1d30, ftLastAccessTime.dwHighDateTime=0x1d5ebb1, ftLastWriteTime.dwLowDateTime=0x4d004f69, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x100e0)) returned 1 [0073.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0073.132] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png" (normalized: "c:\\users\\fd1hvy\\pictures\\7ghd4mepf2l-_-pf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\7GhD4mePf2L-_-pf.png.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\7ghd4mepf2l-_-pf.png.wholocked")) returned 1 [0073.132] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", lpFilePart=0x0) returned 0x2f [0073.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0073.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\felj1zqq4t1nz44zoc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.133] GetFileType (hFile=0x354) returned 0x1 [0073.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0073.133] GetFileType (hFile=0x354) returned 0x1 [0073.133] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x14cf [0073.133] ReadFile (in: hFile=0x354, lpBuffer=0x2e13ff8, nNumberOfBytesToRead=0x14cf, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e13ff8*, lpNumberOfBytesRead=0xefece8*=0x14cf, lpOverlapped=0x0) returned 1 [0073.133] CloseHandle (hObject=0x354) returned 1 [0073.274] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", lpFilePart=0x0) returned 0x2f [0073.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0073.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\felj1zqq4t1nz44zoc.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.275] GetFileType (hFile=0x354) returned 0x1 [0073.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0073.275] GetFileType (hFile=0x354) returned 0x1 [0073.275] WriteFile (in: hFile=0x354, lpBuffer=0x2e67750*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e67750*, lpNumberOfBytesWritten=0xefecdc*=0x14d0, lpOverlapped=0x0) returned 1 [0073.276] CloseHandle (hObject=0x354) returned 1 [0073.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg", lpFilePart=0x0) returned 0x2f [0073.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg.wholocked", lpFilePart=0x0) returned 0x39 [0073.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0073.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\felj1zqq4t1nz44zoc.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc60d2570, ftCreationTime.dwHighDateTime=0x1d5e6bf, ftLastAccessTime.dwLowDateTime=0x28810c80, ftLastAccessTime.dwHighDateTime=0x1d5ee09, ftLastWriteTime.dwLowDateTime=0x4d15c4d1, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x14d0)) returned 1 [0073.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0073.278] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\felj1zqq4t1nz44zoc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\fELj1ZQq4t1nZ44ZOC.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\felj1zqq4t1nz44zoc.jpg.wholocked")) returned 1 [0073.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", lpFilePart=0x0) returned 0x2a [0073.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0073.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ogqec_cm3apnw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.279] GetFileType (hFile=0x354) returned 0x1 [0073.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0073.279] GetFileType (hFile=0x354) returned 0x1 [0073.279] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x460d [0073.279] ReadFile (in: hFile=0x354, lpBuffer=0x2e68fbc, nNumberOfBytesToRead=0x460d, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e68fbc*, lpNumberOfBytesRead=0xefece8*=0x460d, lpOverlapped=0x0) returned 1 [0073.279] CloseHandle (hObject=0x354) returned 1 [0073.295] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", lpFilePart=0x0) returned 0x2a [0073.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0073.295] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ogqec_cm3apnw.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.296] GetFileType (hFile=0x354) returned 0x1 [0073.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0073.296] GetFileType (hFile=0x354) returned 0x1 [0073.296] WriteFile (in: hFile=0x354, lpBuffer=0x2ecbbf8*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ecbbf8*, lpNumberOfBytesWritten=0xefecdc*=0x4610, lpOverlapped=0x0) returned 1 [0073.297] CloseHandle (hObject=0x354) returned 1 [0073.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg", lpFilePart=0x0) returned 0x2a [0073.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg.wholocked", lpFilePart=0x0) returned 0x34 [0073.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0073.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ogqec_cm3apnw.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5f765d0, ftCreationTime.dwHighDateTime=0x1d5e9ed, ftLastAccessTime.dwLowDateTime=0x3093b350, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x4d182728, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x4610)) returned 1 [0073.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0073.299] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ogqec_cm3apnw.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ogqec_cm3apNW.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ogqec_cm3apnw.jpg.wholocked")) returned 1 [0073.299] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0073.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0073.299] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.299] GetFileType (hFile=0x354) returned 0x1 [0073.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0073.299] GetFileType (hFile=0x354) returned 0x1 [0073.300] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x249 [0073.300] ReadFile (in: hFile=0x354, lpBuffer=0x2ed07c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ed07c8*, lpNumberOfBytesRead=0xefece8*=0x249, lpOverlapped=0x0) returned 1 [0073.300] CloseHandle (hObject=0x354) returned 1 [0073.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0073.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0073.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.385] GetFileType (hFile=0x354) returned 0x1 [0073.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0073.385] GetFileType (hFile=0x354) returned 0x1 [0073.385] WriteFile (in: hFile=0x354, lpBuffer=0x2f1f254*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0xefecb0, lpOverlapped=0x0 | out: lpBuffer=0x2f1f254*, lpNumberOfBytesWritten=0xefecb0*=0x250, lpOverlapped=0x0) returned 1 [0073.386] CloseHandle (hObject=0x354) returned 1 [0073.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0073.387] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt.wholocked", lpFilePart=0x0) returned 0x38 [0073.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0073.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b165cf6, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x4b165cf6, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4d278cd0, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0073.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0073.388] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt.wholocked")) returned 1 [0073.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0073.388] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0073.388] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccc58 [0073.390] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.390] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.390] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.391] FindClose (in: hFindFile=0x12ccc58 | out: hFindFile=0x12ccc58) returned 1 [0073.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0073.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0073.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0073.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0073.391] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd218 [0073.391] FindNextFileW (in: hFindFile=0x12cd218, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.391] FindNextFileW (in: hFindFile=0x12cd218, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.391] FindNextFileW (in: hFindFile=0x12cd218, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0073.392] FindClose (in: hFindFile=0x12cd218 | out: hFindFile=0x12cd218) returned 1 [0073.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0073.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0073.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0073.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0073.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0073.393] GetFileType (hFile=0x354) returned 0x1 [0073.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0073.393] GetFileType (hFile=0x354) returned 0x1 [0073.393] WriteFile (in: hFile=0x354, lpBuffer=0x2f23090*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f23090*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0073.394] CloseHandle (hObject=0x354) returned 1 [0073.394] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0073.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0073.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0073.395] GetFileType (hFile=0x354) returned 0x1 [0073.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0073.395] GetFileType (hFile=0x354) returned 0x1 [0073.395] WriteFile (in: hFile=0x354, lpBuffer=0x2f25bdc*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f25bdc*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0073.396] CloseHandle (hObject=0x354) returned 1 [0073.396] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0073.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0073.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0073.397] GetFileType (hFile=0x354) returned 0x1 [0073.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0073.397] GetFileType (hFile=0x354) returned 0x1 [0073.397] WriteFile (in: hFile=0x354, lpBuffer=0x2f28728*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f28728*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0073.398] CloseHandle (hObject=0x354) returned 1 [0073.398] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0073.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0073.398] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0073.399] GetFileType (hFile=0x354) returned 0x1 [0073.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0073.399] GetFileType (hFile=0x354) returned 0x1 [0073.400] WriteFile (in: hFile=0x354, lpBuffer=0x2f2b274*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f2b274*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0073.401] CloseHandle (hObject=0x354) returned 1 [0073.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0073.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je", lpFilePart=0x0) returned 0x29 [0073.401] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccf18 [0073.401] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740e6460, ftCreationTime.dwHighDateTime=0x1d5e27c, ftLastAccessTime.dwLowDateTime=0x92087990, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x92087990, ftLastWriteTime.dwHighDateTime=0x1d5e6ac, nFileSizeHigh=0x0, nFileSizeLow=0xd32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1jsJ70xXCdf1RI_zZ.jpg", cAlternateFileName="1JSJ70~1.JPG")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61414b80, ftCreationTime.dwHighDateTime=0x1d5e322, ftLastAccessTime.dwLowDateTime=0xdf7d5560, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0xdf7d5560, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0xa47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1WQf-NPaR1_fS.bmp", cAlternateFileName="1WQF-N~1.BMP")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd42d30, ftCreationTime.dwHighDateTime=0x1d5e9bb, ftLastAccessTime.dwLowDateTime=0xcd8d9e10, ftLastAccessTime.dwHighDateTime=0x1d5f083, ftLastWriteTime.dwLowDateTime=0xcd8d9e10, ftLastWriteTime.dwHighDateTime=0x1d5f083, nFileSizeHigh=0x0, nFileSizeLow=0xdf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="25MkAmDQPft0eYJtASd.png", cAlternateFileName="25MKAM~1.PNG")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5a71c0, ftCreationTime.dwHighDateTime=0x1d5e8bf, ftLastAccessTime.dwLowDateTime=0x54d8a5c0, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x54d8a5c0, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="4CFxFZRQKwDcILDY.bmp", cAlternateFileName="4CFXFZ~1.BMP")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b02c20, ftCreationTime.dwHighDateTime=0x1d5ebd3, ftLastAccessTime.dwLowDateTime=0xee5056a0, ftLastAccessTime.dwHighDateTime=0x1d5e922, ftLastWriteTime.dwLowDateTime=0xee5056a0, ftLastWriteTime.dwHighDateTime=0x1d5e922, nFileSizeHigh=0x0, nFileSizeLow=0xb49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIFzRN.gif", cAlternateFileName="")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84884bb0, ftCreationTime.dwHighDateTime=0x1d5ea6c, ftLastAccessTime.dwLowDateTime=0x4b61c2e0, ftLastAccessTime.dwHighDateTime=0x1d5f047, ftLastWriteTime.dwLowDateTime=0x4b61c2e0, ftLastWriteTime.dwHighDateTime=0x1d5f047, nFileSizeHigh=0x0, nFileSizeLow=0x159d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOs-d3RGB.gif", cAlternateFileName="BOS-D3~1.GIF")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b14010, ftCreationTime.dwHighDateTime=0x1d5e582, ftLastAccessTime.dwLowDateTime=0xfe9cf6e0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xfe9cf6e0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0xcb6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dq6kwym.bmp", cAlternateFileName="")) returned 1 [0073.402] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edc7020, ftCreationTime.dwHighDateTime=0x1d5ed73, ftLastAccessTime.dwLowDateTime=0xa9912ab0, ftLastAccessTime.dwHighDateTime=0x1d5e311, ftLastWriteTime.dwLowDateTime=0xa9912ab0, ftLastWriteTime.dwHighDateTime=0x1d5e311, nFileSizeHigh=0x0, nFileSizeLow=0x1172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dzjHyypRiE--k0Wc-yR.bmp", cAlternateFileName="DZJHYY~1.BMP")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc19590, ftCreationTime.dwHighDateTime=0x1d5f0a0, ftLastAccessTime.dwLowDateTime=0x8c22670, ftLastAccessTime.dwHighDateTime=0x1d5eb45, ftLastWriteTime.dwLowDateTime=0x8c22670, ftLastWriteTime.dwHighDateTime=0x1d5eb45, nFileSizeHigh=0x0, nFileSizeLow=0xd76f, dwReserved0=0x0, dwReserved1=0x0, cFileName="E-GSfgNxR.bmp", cAlternateFileName="E-GSFG~1.BMP")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e5da10, ftCreationTime.dwHighDateTime=0x1d5e296, ftLastAccessTime.dwLowDateTime=0xc986aae0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0xc986aae0, ftLastWriteTime.dwHighDateTime=0x1d5e927, nFileSizeHigh=0x0, nFileSizeLow=0x4261, dwReserved0=0x0, dwReserved1=0x0, cFileName="fVLVQLFqn.jpg", cAlternateFileName="FVLVQL~1.JPG")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdde8ddf0, ftCreationTime.dwHighDateTime=0x1d5ea8a, ftLastAccessTime.dwLowDateTime=0xbaa22670, ftLastAccessTime.dwHighDateTime=0x1d5e8d3, ftLastWriteTime.dwLowDateTime=0xbaa22670, ftLastWriteTime.dwHighDateTime=0x1d5e8d3, nFileSizeHigh=0x0, nFileSizeLow=0x16edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HE1cOeIv-OO97.gif", cAlternateFileName="HE1COE~1.GIF")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6193e820, ftCreationTime.dwHighDateTime=0x1d5e72f, ftLastAccessTime.dwLowDateTime=0xe7bd99a0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0xe7bd99a0, ftLastWriteTime.dwHighDateTime=0x1d5e3a1, nFileSizeHigh=0x0, nFileSizeLow=0xc5d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="hL0gWktZswbztF.bmp", cAlternateFileName="HL0GWK~1.BMP")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b6ef00, ftCreationTime.dwHighDateTime=0x1d5ed95, ftLastAccessTime.dwLowDateTime=0x13dce3d0, ftLastAccessTime.dwHighDateTime=0x1d5e887, ftLastWriteTime.dwLowDateTime=0x13dce3d0, ftLastWriteTime.dwHighDateTime=0x1d5e887, nFileSizeHigh=0x0, nFileSizeLow=0x5686, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLRhFj0428Ops.gif", cAlternateFileName="NLRHFJ~1.GIF")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c234b0, ftCreationTime.dwHighDateTime=0x1d5e5e6, ftLastAccessTime.dwLowDateTime=0xfd6da10, ftLastAccessTime.dwHighDateTime=0x1d5ea36, ftLastWriteTime.dwLowDateTime=0xfd6da10, ftLastWriteTime.dwHighDateTime=0x1d5ea36, nFileSizeHigh=0x0, nFileSizeLow=0x1712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmD1fCwrxHA.jpg", cAlternateFileName="NMD1FC~1.JPG")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31cfbf30, ftCreationTime.dwHighDateTime=0x1d5ebc9, ftLastAccessTime.dwLowDateTime=0xe62a1800, ftLastAccessTime.dwHighDateTime=0x1d5edcb, ftLastWriteTime.dwLowDateTime=0xe62a1800, ftLastWriteTime.dwHighDateTime=0x1d5edcb, nFileSizeHigh=0x0, nFileSizeLow=0x7adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="oh6K37gFIr4Flf.bmp", cAlternateFileName="OH6K37~1.BMP")) returned 1 [0073.403] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeef139b0, ftCreationTime.dwHighDateTime=0x1d5e631, ftLastAccessTime.dwLowDateTime=0xf80c5cc0, ftLastAccessTime.dwHighDateTime=0x1d5ec56, ftLastWriteTime.dwLowDateTime=0xf80c5cc0, ftLastWriteTime.dwHighDateTime=0x1d5ec56, nFileSizeHigh=0x0, nFileSizeLow=0xbabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEHl4.bmp", cAlternateFileName="")) returned 1 [0073.404] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741684a0, ftCreationTime.dwHighDateTime=0x1d5ea25, ftLastAccessTime.dwLowDateTime=0xb5a7d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0xb5a7d2a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xe8d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="T-V5AoWAZz.png", cAlternateFileName="T-V5AO~1.PNG")) returned 1 [0073.404] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6597f290, ftCreationTime.dwHighDateTime=0x1d5f0a3, ftLastAccessTime.dwLowDateTime=0x9f2b6660, ftLastAccessTime.dwHighDateTime=0x1d5f04c, ftLastWriteTime.dwLowDateTime=0x9f2b6660, ftLastWriteTime.dwHighDateTime=0x1d5f04c, nFileSizeHigh=0x0, nFileSizeLow=0xca33, dwReserved0=0x0, dwReserved1=0x0, cFileName="v61fFoSouyeG_z.gif", cAlternateFileName="V61FFO~1.GIF")) returned 1 [0073.404] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb55c4020, ftCreationTime.dwHighDateTime=0x1d5ea76, ftLastAccessTime.dwLowDateTime=0xf5349080, ftLastAccessTime.dwHighDateTime=0x1d5ed5a, ftLastWriteTime.dwLowDateTime=0xf5349080, ftLastWriteTime.dwHighDateTime=0x1d5ed5a, nFileSizeHigh=0x0, nFileSizeLow=0x112c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4ah3iCqOx-t oe.jpg", cAlternateFileName="X4AH3I~1.JPG")) returned 1 [0073.404] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a6d2c0, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0x86458160, ftLastAccessTime.dwHighDateTime=0x1d5ebf3, ftLastWriteTime.dwLowDateTime=0x86458160, ftLastWriteTime.dwHighDateTime=0x1d5ebf3, nFileSizeHigh=0x0, nFileSizeLow=0x18899, dwReserved0=0x0, dwReserved1=0x0, cFileName="zbZo5dm.gif", cAlternateFileName="")) returned 1 [0073.404] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.404] FindClose (in: hFindFile=0x12ccf18 | out: hFindFile=0x12ccf18) returned 1 [0073.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0073.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0073.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0073.404] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je", lpFilePart=0x0) returned 0x29 [0073.404] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd098 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37aaea90, ftCreationTime.dwHighDateTime=0x1d5eced, ftLastAccessTime.dwLowDateTime=0xcb783920, ftLastAccessTime.dwHighDateTime=0x1d5e42e, ftLastWriteTime.dwLowDateTime=0xcb783920, ftLastWriteTime.dwHighDateTime=0x1d5e42e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740e6460, ftCreationTime.dwHighDateTime=0x1d5e27c, ftLastAccessTime.dwLowDateTime=0x92087990, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x92087990, ftLastWriteTime.dwHighDateTime=0x1d5e6ac, nFileSizeHigh=0x0, nFileSizeLow=0xd32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1jsJ70xXCdf1RI_zZ.jpg", cAlternateFileName="1JSJ70~1.JPG")) returned 1 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61414b80, ftCreationTime.dwHighDateTime=0x1d5e322, ftLastAccessTime.dwLowDateTime=0xdf7d5560, ftLastAccessTime.dwHighDateTime=0x1d5ee13, ftLastWriteTime.dwLowDateTime=0xdf7d5560, ftLastWriteTime.dwHighDateTime=0x1d5ee13, nFileSizeHigh=0x0, nFileSizeLow=0xa47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1WQf-NPaR1_fS.bmp", cAlternateFileName="1WQF-N~1.BMP")) returned 1 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd42d30, ftCreationTime.dwHighDateTime=0x1d5e9bb, ftLastAccessTime.dwLowDateTime=0xcd8d9e10, ftLastAccessTime.dwHighDateTime=0x1d5f083, ftLastWriteTime.dwLowDateTime=0xcd8d9e10, ftLastWriteTime.dwHighDateTime=0x1d5f083, nFileSizeHigh=0x0, nFileSizeLow=0xdf7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="25MkAmDQPft0eYJtASd.png", cAlternateFileName="25MKAM~1.PNG")) returned 1 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee5a71c0, ftCreationTime.dwHighDateTime=0x1d5e8bf, ftLastAccessTime.dwLowDateTime=0x54d8a5c0, ftLastAccessTime.dwHighDateTime=0x1d5e43d, ftLastWriteTime.dwLowDateTime=0x54d8a5c0, ftLastWriteTime.dwHighDateTime=0x1d5e43d, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x0, dwReserved1=0x0, cFileName="4CFxFZRQKwDcILDY.bmp", cAlternateFileName="4CFXFZ~1.BMP")) returned 1 [0073.405] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b02c20, ftCreationTime.dwHighDateTime=0x1d5ebd3, ftLastAccessTime.dwLowDateTime=0xee5056a0, ftLastAccessTime.dwHighDateTime=0x1d5e922, ftLastWriteTime.dwLowDateTime=0xee5056a0, ftLastWriteTime.dwHighDateTime=0x1d5e922, nFileSizeHigh=0x0, nFileSizeLow=0xb49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIFzRN.gif", cAlternateFileName="")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84884bb0, ftCreationTime.dwHighDateTime=0x1d5ea6c, ftLastAccessTime.dwLowDateTime=0x4b61c2e0, ftLastAccessTime.dwHighDateTime=0x1d5f047, ftLastWriteTime.dwLowDateTime=0x4b61c2e0, ftLastWriteTime.dwHighDateTime=0x1d5f047, nFileSizeHigh=0x0, nFileSizeLow=0x159d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOs-d3RGB.gif", cAlternateFileName="BOS-D3~1.GIF")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b14010, ftCreationTime.dwHighDateTime=0x1d5e582, ftLastAccessTime.dwLowDateTime=0xfe9cf6e0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xfe9cf6e0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0xcb6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dq6kwym.bmp", cAlternateFileName="")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edc7020, ftCreationTime.dwHighDateTime=0x1d5ed73, ftLastAccessTime.dwLowDateTime=0xa9912ab0, ftLastAccessTime.dwHighDateTime=0x1d5e311, ftLastWriteTime.dwLowDateTime=0xa9912ab0, ftLastWriteTime.dwHighDateTime=0x1d5e311, nFileSizeHigh=0x0, nFileSizeLow=0x1172a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dzjHyypRiE--k0Wc-yR.bmp", cAlternateFileName="DZJHYY~1.BMP")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc19590, ftCreationTime.dwHighDateTime=0x1d5f0a0, ftLastAccessTime.dwLowDateTime=0x8c22670, ftLastAccessTime.dwHighDateTime=0x1d5eb45, ftLastWriteTime.dwLowDateTime=0x8c22670, ftLastWriteTime.dwHighDateTime=0x1d5eb45, nFileSizeHigh=0x0, nFileSizeLow=0xd76f, dwReserved0=0x0, dwReserved1=0x0, cFileName="E-GSfgNxR.bmp", cAlternateFileName="E-GSFG~1.BMP")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e5da10, ftCreationTime.dwHighDateTime=0x1d5e296, ftLastAccessTime.dwLowDateTime=0xc986aae0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0xc986aae0, ftLastWriteTime.dwHighDateTime=0x1d5e927, nFileSizeHigh=0x0, nFileSizeLow=0x4261, dwReserved0=0x0, dwReserved1=0x0, cFileName="fVLVQLFqn.jpg", cAlternateFileName="FVLVQL~1.JPG")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdde8ddf0, ftCreationTime.dwHighDateTime=0x1d5ea8a, ftLastAccessTime.dwLowDateTime=0xbaa22670, ftLastAccessTime.dwHighDateTime=0x1d5e8d3, ftLastWriteTime.dwLowDateTime=0xbaa22670, ftLastWriteTime.dwHighDateTime=0x1d5e8d3, nFileSizeHigh=0x0, nFileSizeLow=0x16edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HE1cOeIv-OO97.gif", cAlternateFileName="HE1COE~1.GIF")) returned 1 [0073.406] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6193e820, ftCreationTime.dwHighDateTime=0x1d5e72f, ftLastAccessTime.dwLowDateTime=0xe7bd99a0, ftLastAccessTime.dwHighDateTime=0x1d5e3a1, ftLastWriteTime.dwLowDateTime=0xe7bd99a0, ftLastWriteTime.dwHighDateTime=0x1d5e3a1, nFileSizeHigh=0x0, nFileSizeLow=0xc5d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="hL0gWktZswbztF.bmp", cAlternateFileName="HL0GWK~1.BMP")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b6ef00, ftCreationTime.dwHighDateTime=0x1d5ed95, ftLastAccessTime.dwLowDateTime=0x13dce3d0, ftLastAccessTime.dwHighDateTime=0x1d5e887, ftLastWriteTime.dwLowDateTime=0x13dce3d0, ftLastWriteTime.dwHighDateTime=0x1d5e887, nFileSizeHigh=0x0, nFileSizeLow=0x5686, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLRhFj0428Ops.gif", cAlternateFileName="NLRHFJ~1.GIF")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c234b0, ftCreationTime.dwHighDateTime=0x1d5e5e6, ftLastAccessTime.dwLowDateTime=0xfd6da10, ftLastAccessTime.dwHighDateTime=0x1d5ea36, ftLastWriteTime.dwLowDateTime=0xfd6da10, ftLastWriteTime.dwHighDateTime=0x1d5ea36, nFileSizeHigh=0x0, nFileSizeLow=0x1712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="nmD1fCwrxHA.jpg", cAlternateFileName="NMD1FC~1.JPG")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31cfbf30, ftCreationTime.dwHighDateTime=0x1d5ebc9, ftLastAccessTime.dwLowDateTime=0xe62a1800, ftLastAccessTime.dwHighDateTime=0x1d5edcb, ftLastWriteTime.dwLowDateTime=0xe62a1800, ftLastWriteTime.dwHighDateTime=0x1d5edcb, nFileSizeHigh=0x0, nFileSizeLow=0x7adc, dwReserved0=0x0, dwReserved1=0x0, cFileName="oh6K37gFIr4Flf.bmp", cAlternateFileName="OH6K37~1.BMP")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeef139b0, ftCreationTime.dwHighDateTime=0x1d5e631, ftLastAccessTime.dwLowDateTime=0xf80c5cc0, ftLastAccessTime.dwHighDateTime=0x1d5ec56, ftLastWriteTime.dwLowDateTime=0xf80c5cc0, ftLastWriteTime.dwHighDateTime=0x1d5ec56, nFileSizeHigh=0x0, nFileSizeLow=0xbabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEHl4.bmp", cAlternateFileName="")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741684a0, ftCreationTime.dwHighDateTime=0x1d5ea25, ftLastAccessTime.dwLowDateTime=0xb5a7d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0xb5a7d2a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xe8d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="T-V5AoWAZz.png", cAlternateFileName="T-V5AO~1.PNG")) returned 1 [0073.407] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6597f290, ftCreationTime.dwHighDateTime=0x1d5f0a3, ftLastAccessTime.dwLowDateTime=0x9f2b6660, ftLastAccessTime.dwHighDateTime=0x1d5f04c, ftLastWriteTime.dwLowDateTime=0x9f2b6660, ftLastWriteTime.dwHighDateTime=0x1d5f04c, nFileSizeHigh=0x0, nFileSizeLow=0xca33, dwReserved0=0x0, dwReserved1=0x0, cFileName="v61fFoSouyeG_z.gif", cAlternateFileName="V61FFO~1.GIF")) returned 1 [0073.408] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb55c4020, ftCreationTime.dwHighDateTime=0x1d5ea76, ftLastAccessTime.dwLowDateTime=0xf5349080, ftLastAccessTime.dwHighDateTime=0x1d5ed5a, ftLastWriteTime.dwLowDateTime=0xf5349080, ftLastWriteTime.dwHighDateTime=0x1d5ed5a, nFileSizeHigh=0x0, nFileSizeLow=0x112c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4ah3iCqOx-t oe.jpg", cAlternateFileName="X4AH3I~1.JPG")) returned 1 [0073.408] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a6d2c0, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0x86458160, ftLastAccessTime.dwHighDateTime=0x1d5ebf3, ftLastWriteTime.dwLowDateTime=0x86458160, ftLastWriteTime.dwHighDateTime=0x1d5ebf3, nFileSizeHigh=0x0, nFileSizeLow=0x18899, dwReserved0=0x0, dwReserved1=0x0, cFileName="zbZo5dm.gif", cAlternateFileName="")) returned 1 [0073.408] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58a6d2c0, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0x86458160, ftLastAccessTime.dwHighDateTime=0x1d5ebf3, ftLastWriteTime.dwLowDateTime=0x86458160, ftLastWriteTime.dwHighDateTime=0x1d5ebf3, nFileSizeHigh=0x0, nFileSizeLow=0x18899, dwReserved0=0x0, dwReserved1=0x0, cFileName="zbZo5dm.gif", cAlternateFileName="")) returned 0 [0073.408] FindClose (in: hFindFile=0x12cd098 | out: hFindFile=0x12cd098) returned 1 [0073.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0073.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0073.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", lpFilePart=0x0) returned 0x3f [0073.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\1jsj70xxcdf1ri_zz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.408] GetFileType (hFile=0x354) returned 0x1 [0073.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.408] GetFileType (hFile=0x354) returned 0x1 [0073.408] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xd32e [0073.409] ReadFile (in: hFile=0x354, lpBuffer=0x2f31188, nNumberOfBytesToRead=0xd32e, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f31188*, lpNumberOfBytesRead=0xefec60*=0xd32e, lpOverlapped=0x0) returned 1 [0073.409] CloseHandle (hObject=0x354) returned 1 [0073.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", lpFilePart=0x0) returned 0x3f [0073.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0073.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\1jsj70xxcdf1ri_zz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.489] GetFileType (hFile=0x354) returned 0x1 [0073.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0073.489] GetFileType (hFile=0x354) returned 0x1 [0073.489] WriteFile (in: hFile=0x354, lpBuffer=0x2fa5918*, nNumberOfBytesToWrite=0xd330, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fa5918*, lpNumberOfBytesWritten=0xefec54*=0xd330, lpOverlapped=0x0) returned 1 [0073.490] CloseHandle (hObject=0x354) returned 1 [0073.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg", lpFilePart=0x0) returned 0x3f [0073.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg.wholocked", lpFilePart=0x0) returned 0x49 [0073.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0073.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\1jsj70xxcdf1ri_zz.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x740e6460, ftCreationTime.dwHighDateTime=0x1d5e27c, ftLastAccessTime.dwLowDateTime=0x92087990, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x4d35dca0, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xd330)) returned 1 [0073.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0073.493] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\1jsj70xxcdf1ri_zz.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\1jsJ70xXCdf1RI_zZ.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\1jsj70xxcdf1ri_zz.jpg.wholocked")) returned 1 [0073.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", lpFilePart=0x0) returned 0x41 [0073.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\25mkamdqpft0eyjtasd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.494] GetFileType (hFile=0x354) returned 0x1 [0073.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.494] GetFileType (hFile=0x354) returned 0x1 [0073.494] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xdf7c [0073.494] ReadFile (in: hFile=0x354, lpBuffer=0x2fb3098, nNumberOfBytesToRead=0xdf7c, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2fb3098*, lpNumberOfBytesRead=0xefec60*=0xdf7c, lpOverlapped=0x0) returned 1 [0073.494] CloseHandle (hObject=0x354) returned 1 [0073.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", lpFilePart=0x0) returned 0x41 [0073.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0073.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\25mkamdqpft0eyjtasd.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.584] GetFileType (hFile=0x354) returned 0x1 [0073.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0073.584] GetFileType (hFile=0x354) returned 0x1 [0073.584] WriteFile (in: hFile=0x354, lpBuffer=0x2e39168*, nNumberOfBytesToWrite=0xdf80, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e39168*, lpNumberOfBytesWritten=0xefec54*=0xdf80, lpOverlapped=0x0) returned 1 [0073.586] CloseHandle (hObject=0x354) returned 1 [0073.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png", lpFilePart=0x0) returned 0x41 [0073.588] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png.wholocked", lpFilePart=0x0) returned 0x4b [0073.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0073.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\25mkamdqpft0eyjtasd.png"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd42d30, ftCreationTime.dwHighDateTime=0x1d5e9bb, ftLastAccessTime.dwLowDateTime=0xcd8d9e10, ftLastAccessTime.dwHighDateTime=0x1d5f083, ftLastWriteTime.dwLowDateTime=0x4d442a98, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xdf80)) returned 1 [0073.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0073.588] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\25mkamdqpft0eyjtasd.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\25MkAmDQPft0eYJtASd.png.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\25mkamdqpft0eyjtasd.png.wholocked")) returned 1 [0073.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", lpFilePart=0x0) returned 0x37 [0073.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\fvlvqlfqn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.631] GetFileType (hFile=0x354) returned 0x1 [0073.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.631] GetFileType (hFile=0x354) returned 0x1 [0073.632] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x4261 [0073.632] ReadFile (in: hFile=0x354, lpBuffer=0x2e4759c, nNumberOfBytesToRead=0x4261, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2e4759c*, lpNumberOfBytesRead=0xefec60*=0x4261, lpOverlapped=0x0) returned 1 [0073.632] CloseHandle (hObject=0x354) returned 1 [0073.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", lpFilePart=0x0) returned 0x37 [0073.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0073.695] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\fvlvqlfqn.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.696] GetFileType (hFile=0x354) returned 0x1 [0073.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0073.696] GetFileType (hFile=0x354) returned 0x1 [0073.696] WriteFile (in: hFile=0x354, lpBuffer=0x2ea9114*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2ea9114*, lpNumberOfBytesWritten=0xefec54*=0x4270, lpOverlapped=0x0) returned 1 [0073.697] CloseHandle (hObject=0x354) returned 1 [0073.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg", lpFilePart=0x0) returned 0x37 [0073.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg.wholocked", lpFilePart=0x0) returned 0x41 [0073.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0073.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\fvlvqlfqn.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e5da10, ftCreationTime.dwHighDateTime=0x1d5e296, ftLastAccessTime.dwLowDateTime=0xc986aae0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0x4d573f71, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x4270)) returned 1 [0073.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0073.699] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\fvlvqlfqn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\fVLVQLFqn.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\fvlvqlfqn.jpg.wholocked")) returned 1 [0073.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", lpFilePart=0x0) returned 0x39 [0073.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.700] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\nmd1fcwrxha.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.700] GetFileType (hFile=0x354) returned 0x1 [0073.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.700] GetFileType (hFile=0x354) returned 0x1 [0073.700] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x1712e [0073.700] ReadFile (in: hFile=0x354, lpBuffer=0x4037568, nNumberOfBytesToRead=0x1712e, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x4037568*, lpNumberOfBytesRead=0xefec60*=0x1712e, lpOverlapped=0x0) returned 1 [0073.702] CloseHandle (hObject=0x354) returned 1 [0073.724] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", lpFilePart=0x0) returned 0x39 [0073.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0073.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\nmd1fcwrxha.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.725] GetFileType (hFile=0x354) returned 0x1 [0073.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0073.725] GetFileType (hFile=0x354) returned 0x1 [0073.725] WriteFile (in: hFile=0x354, lpBuffer=0x40aab98*, nNumberOfBytesToWrite=0x17130, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x40aab98*, lpNumberOfBytesWritten=0xefec54*=0x17130, lpOverlapped=0x0) returned 1 [0073.727] CloseHandle (hObject=0x354) returned 1 [0073.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg", lpFilePart=0x0) returned 0x39 [0073.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg.wholocked", lpFilePart=0x0) returned 0x43 [0073.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0073.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\nmd1fcwrxha.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c234b0, ftCreationTime.dwHighDateTime=0x1d5e5e6, ftLastAccessTime.dwLowDateTime=0xfd6da10, ftLastAccessTime.dwHighDateTime=0x1d5ea36, ftLastWriteTime.dwLowDateTime=0x4d6325e0, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17130)) returned 1 [0073.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0073.777] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\nmd1fcwrxha.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\nmD1fCwrxHA.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\nmd1fcwrxha.jpg.wholocked")) returned 1 [0073.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", lpFilePart=0x0) returned 0x38 [0073.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\t-v5aowazz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.778] GetFileType (hFile=0x354) returned 0x1 [0073.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.778] GetFileType (hFile=0x354) returned 0x1 [0073.778] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xe8d5 [0073.779] ReadFile (in: hFile=0x354, lpBuffer=0x2efa990, nNumberOfBytesToRead=0xe8d5, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2efa990*, lpNumberOfBytesRead=0xefec60*=0xe8d5, lpOverlapped=0x0) returned 1 [0073.779] CloseHandle (hObject=0x354) returned 1 [0073.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", lpFilePart=0x0) returned 0x38 [0073.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0073.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\t-v5aowazz.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.901] GetFileType (hFile=0x354) returned 0x1 [0073.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0073.901] GetFileType (hFile=0x354) returned 0x1 [0073.901] WriteFile (in: hFile=0x354, lpBuffer=0x2dec15c*, nNumberOfBytesToWrite=0xe8e0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2dec15c*, lpNumberOfBytesWritten=0xefec54*=0xe8e0, lpOverlapped=0x0) returned 1 [0073.903] CloseHandle (hObject=0x354) returned 1 [0073.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png", lpFilePart=0x0) returned 0x38 [0073.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png.wholocked", lpFilePart=0x0) returned 0x42 [0073.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0073.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\t-v5aowazz.png"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741684a0, ftCreationTime.dwHighDateTime=0x1d5ea25, ftLastAccessTime.dwLowDateTime=0xb5a7d2a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x4d763b08, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xe8e0)) returned 1 [0073.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0073.906] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\t-v5aowazz.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\T-V5AoWAZz.png.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\t-v5aowazz.png.wholocked")) returned 1 [0073.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", lpFilePart=0x0) returned 0x3d [0073.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0073.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\x4ah3icqox-t oe.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.907] GetFileType (hFile=0x354) returned 0x1 [0073.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0073.907] GetFileType (hFile=0x354) returned 0x1 [0073.907] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x112c2 [0073.907] ReadFile (in: hFile=0x354, lpBuffer=0x2dfae40, nNumberOfBytesToRead=0x112c2, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2dfae40*, lpNumberOfBytesRead=0xefec60*=0x112c2, lpOverlapped=0x0) returned 1 [0073.907] CloseHandle (hObject=0x354) returned 1 [0074.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", lpFilePart=0x0) returned 0x3d [0074.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0074.001] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\x4ah3icqox-t oe.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.042] GetFileType (hFile=0x260) returned 0x1 [0074.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0074.043] GetFileType (hFile=0x260) returned 0x1 [0074.043] WriteFile (in: hFile=0x260, lpBuffer=0x2e7b60c*, nNumberOfBytesToWrite=0x112d0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e7b60c*, lpNumberOfBytesWritten=0xefec54*=0x112d0, lpOverlapped=0x0) returned 1 [0074.045] CloseHandle (hObject=0x260) returned 1 [0074.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg", lpFilePart=0x0) returned 0x3d [0074.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg.wholocked", lpFilePart=0x0) returned 0x47 [0074.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0074.047] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\x4ah3icqox-t oe.jpg"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb55c4020, ftCreationTime.dwHighDateTime=0x1d5ea76, ftLastAccessTime.dwLowDateTime=0xf5349080, ftLastAccessTime.dwHighDateTime=0x1d5ed5a, ftLastWriteTime.dwLowDateTime=0x4d8bb027, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x112d0)) returned 1 [0074.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0074.047] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\x4ah3icqox-t oe.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\rO35ytMPEV-Qo1Je\\x4ah3iCqOx-t oe.jpg.wholocked" (normalized: "c:\\users\\fd1hvy\\pictures\\ro35ytmpev-qo1je\\x4ah3icqox-t oe.jpg.wholocked")) returned 1 [0074.048] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0074.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.048] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.049] GetFileType (hFile=0x260) returned 0x1 [0074.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.049] GetFileType (hFile=0x260) returned 0x1 [0074.049] WriteFile (in: hFile=0x260, lpBuffer=0x2e8e710*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e8e710*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.050] CloseHandle (hObject=0x260) returned 1 [0074.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0074.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.050] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.051] GetFileType (hFile=0x260) returned 0x1 [0074.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.051] GetFileType (hFile=0x260) returned 0x1 [0074.052] WriteFile (in: hFile=0x260, lpBuffer=0x2e9125c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e9125c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.052] CloseHandle (hObject=0x260) returned 1 [0074.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0074.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.053] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.053] GetFileType (hFile=0x260) returned 0x1 [0074.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.053] GetFileType (hFile=0x260) returned 0x1 [0074.054] WriteFile (in: hFile=0x260, lpBuffer=0x2e93da8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e93da8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.054] CloseHandle (hObject=0x260) returned 1 [0074.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0074.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.056] GetFileType (hFile=0x260) returned 0x1 [0074.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.056] GetFileType (hFile=0x260) returned 0x1 [0074.056] WriteFile (in: hFile=0x260, lpBuffer=0x2e968f4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e968f4*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.057] CloseHandle (hObject=0x260) returned 1 [0074.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0074.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0074.057] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cce98 [0074.058] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.058] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.058] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.058] FindClose (in: hFindFile=0x12cce98 | out: hFindFile=0x12cce98) returned 1 [0074.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0074.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0074.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0074.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0074.059] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd198 [0074.059] FindNextFileW (in: hFindFile=0x12cd198, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.059] FindNextFileW (in: hFindFile=0x12cd198, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.059] FindNextFileW (in: hFindFile=0x12cd198, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0074.059] FindClose (in: hFindFile=0x12cd198 | out: hFindFile=0x12cd198) returned 1 [0074.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0074.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0074.059] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0074.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.060] GetFileType (hFile=0x260) returned 0x1 [0074.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.060] GetFileType (hFile=0x260) returned 0x1 [0074.061] WriteFile (in: hFile=0x260, lpBuffer=0x2e9a60c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e9a60c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.061] CloseHandle (hObject=0x260) returned 1 [0074.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0074.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.062] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.062] GetFileType (hFile=0x260) returned 0x1 [0074.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.063] GetFileType (hFile=0x260) returned 0x1 [0074.063] WriteFile (in: hFile=0x260, lpBuffer=0x2e9d158*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e9d158*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.064] CloseHandle (hObject=0x260) returned 1 [0074.064] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0074.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.064] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.065] GetFileType (hFile=0x260) returned 0x1 [0074.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.065] GetFileType (hFile=0x260) returned 0x1 [0074.065] WriteFile (in: hFile=0x260, lpBuffer=0x2e9fca4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e9fca4*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.066] CloseHandle (hObject=0x260) returned 1 [0074.066] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0074.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0074.066] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0074.067] GetFileType (hFile=0x260) returned 0x1 [0074.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0074.067] GetFileType (hFile=0x260) returned 0x1 [0074.067] WriteFile (in: hFile=0x260, lpBuffer=0x2ea27f0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2ea27f0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0074.068] CloseHandle (hObject=0x260) returned 1 [0074.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0074.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\", lpFilePart=0x0) returned 0x16 [0074.068] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe53eb8a4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe53eb8a4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd298 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe53eb8a4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe53eb8a4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16a73f50, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x53b2ce60, ftLastAccessTime.dwHighDateTime=0x1d5eb17, ftLastWriteTime.dwLowDateTime=0x53b2ce60, ftLastWriteTime.dwHighDateTime=0x1d5eb17, nFileSizeHigh=0x0, nFileSizeLow=0x158df, dwReserved0=0x0, dwReserved1=0x0, cFileName="0IF7-c-x3.wav", cAlternateFileName="0IF7-C~1.WAV")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="biZK6", cAlternateFileName="")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FkUmlyV", cAlternateFileName="")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92f1ae0, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0xfe9aa550, ftLastAccessTime.dwHighDateTime=0x1d5e8b5, ftLastWriteTime.dwLowDateTime=0xfe9aa550, ftLastWriteTime.dwHighDateTime=0x1d5e8b5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="fz69LSe1soXmFNQH-lmy.wav", cAlternateFileName="FZ69LS~1.WAV")) returned 1 [0074.069] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JLQO-OboxE_dRiRf0", cAlternateFileName="JLQO-O~1")) returned 1 [0074.070] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b2950, ftCreationTime.dwHighDateTime=0x1d5eb2b, ftLastAccessTime.dwLowDateTime=0xf5877690, ftLastAccessTime.dwHighDateTime=0x1d5f03b, ftLastWriteTime.dwLowDateTime=0xf5877690, ftLastWriteTime.dwHighDateTime=0x1d5f03b, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="uCHNgbcEJfjMGu.mp3", cAlternateFileName="UCHNGB~1.MP3")) returned 1 [0074.070] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba765c60, ftCreationTime.dwHighDateTime=0x1d5e56e, ftLastAccessTime.dwLowDateTime=0x654be9b0, ftLastAccessTime.dwHighDateTime=0x1d5ee17, ftLastWriteTime.dwLowDateTime=0x654be9b0, ftLastWriteTime.dwHighDateTime=0x1d5ee17, nFileSizeHigh=0x0, nFileSizeLow=0xf961, dwReserved0=0x0, dwReserved1=0x0, cFileName="vUf9cNx.m4a", cAlternateFileName="")) returned 1 [0074.070] FindNextFileW (in: hFindFile=0x12cd298, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.070] FindClose (in: hFindFile=0x12cd298 | out: hFindFile=0x12cd298) returned 1 [0074.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0074.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0074.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0074.070] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\", lpFilePart=0x0) returned 0x16 [0074.070] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe53eb8a4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe53eb8a4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd098 [0074.070] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe53eb8a4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe53eb8a4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.070] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16a73f50, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x53b2ce60, ftLastAccessTime.dwHighDateTime=0x1d5eb17, ftLastWriteTime.dwLowDateTime=0x53b2ce60, ftLastWriteTime.dwHighDateTime=0x1d5eb17, nFileSizeHigh=0x0, nFileSizeLow=0x158df, dwReserved0=0x0, dwReserved1=0x0, cFileName="0IF7-c-x3.wav", cAlternateFileName="0IF7-C~1.WAV")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="biZK6", cAlternateFileName="")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FkUmlyV", cAlternateFileName="")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92f1ae0, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0xfe9aa550, ftLastAccessTime.dwHighDateTime=0x1d5e8b5, ftLastWriteTime.dwLowDateTime=0xfe9aa550, ftLastWriteTime.dwHighDateTime=0x1d5e8b5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="fz69LSe1soXmFNQH-lmy.wav", cAlternateFileName="FZ69LS~1.WAV")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JLQO-OboxE_dRiRf0", cAlternateFileName="JLQO-O~1")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b2950, ftCreationTime.dwHighDateTime=0x1d5eb2b, ftLastAccessTime.dwLowDateTime=0xf5877690, ftLastAccessTime.dwHighDateTime=0x1d5f03b, ftLastWriteTime.dwLowDateTime=0xf5877690, ftLastWriteTime.dwHighDateTime=0x1d5f03b, nFileSizeHigh=0x0, nFileSizeLow=0x6e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="uCHNgbcEJfjMGu.mp3", cAlternateFileName="UCHNGB~1.MP3")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba765c60, ftCreationTime.dwHighDateTime=0x1d5e56e, ftLastAccessTime.dwLowDateTime=0x654be9b0, ftLastAccessTime.dwHighDateTime=0x1d5ee17, ftLastWriteTime.dwLowDateTime=0x654be9b0, ftLastWriteTime.dwHighDateTime=0x1d5ee17, nFileSizeHigh=0x0, nFileSizeLow=0xf961, dwReserved0=0x0, dwReserved1=0x0, cFileName="vUf9cNx.m4a", cAlternateFileName="")) returned 1 [0074.072] FindNextFileW (in: hFindFile=0x12cd098, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba765c60, ftCreationTime.dwHighDateTime=0x1d5e56e, ftLastAccessTime.dwLowDateTime=0x654be9b0, ftLastAccessTime.dwHighDateTime=0x1d5ee17, ftLastWriteTime.dwLowDateTime=0x654be9b0, ftLastWriteTime.dwHighDateTime=0x1d5ee17, nFileSizeHigh=0x0, nFileSizeLow=0xf961, dwReserved0=0x0, dwReserved1=0x0, cFileName="vUf9cNx.m4a", cAlternateFileName="")) returned 0 [0074.072] FindClose (in: hFindFile=0x12cd098 | out: hFindFile=0x12cd098) returned 1 [0074.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0074.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0074.072] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", lpFilePart=0x0) returned 0x23 [0074.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0074.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav" (normalized: "c:\\users\\fd1hvy\\music\\0if7-c-x3.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.072] GetFileType (hFile=0x260) returned 0x1 [0074.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.072] GetFileType (hFile=0x260) returned 0x1 [0074.072] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x158df [0074.073] ReadFile (in: hFile=0x260, lpBuffer=0x3df15c8, nNumberOfBytesToRead=0x158df, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x3df15c8*, lpNumberOfBytesRead=0xefece8*=0x158df, lpOverlapped=0x0) returned 1 [0074.075] CloseHandle (hObject=0x260) returned 1 [0074.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", lpFilePart=0x0) returned 0x23 [0074.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0074.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav" (normalized: "c:\\users\\fd1hvy\\music\\0if7-c-x3.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.344] GetFileType (hFile=0x260) returned 0x1 [0074.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0074.344] GetFileType (hFile=0x260) returned 0x1 [0074.344] WriteFile (in: hFile=0x260, lpBuffer=0x3e5d268*, nNumberOfBytesToWrite=0x158e0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x3e5d268*, lpNumberOfBytesWritten=0xefecdc*=0x158e0, lpOverlapped=0x0) returned 1 [0074.346] CloseHandle (hObject=0x260) returned 1 [0074.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav", lpFilePart=0x0) returned 0x23 [0074.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav.wholocked", lpFilePart=0x0) returned 0x2d [0074.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0074.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav" (normalized: "c:\\users\\fd1hvy\\music\\0if7-c-x3.wav"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16a73f50, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x53b2ce60, ftLastAccessTime.dwHighDateTime=0x1d5eb17, ftLastWriteTime.dwLowDateTime=0x4db8fa9e, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x158e0)) returned 1 [0074.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0074.349] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav" (normalized: "c:\\users\\fd1hvy\\music\\0if7-c-x3.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\0IF7-c-x3.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\0if7-c-x3.wav.wholocked")) returned 1 [0074.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", lpFilePart=0x0) returned 0x2e [0074.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0074.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav" (normalized: "c:\\users\\fd1hvy\\music\\fz69lse1soxmfnqh-lmy.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.350] GetFileType (hFile=0x260) returned 0x1 [0074.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.350] GetFileType (hFile=0x260) returned 0x1 [0074.350] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x81ab [0074.350] ReadFile (in: hFile=0x260, lpBuffer=0x2ef2830, nNumberOfBytesToRead=0x81ab, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2ef2830*, lpNumberOfBytesRead=0xefece8*=0x81ab, lpOverlapped=0x0) returned 1 [0074.350] CloseHandle (hObject=0x260) returned 1 [0074.375] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", lpFilePart=0x0) returned 0x2e [0074.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0074.375] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav" (normalized: "c:\\users\\fd1hvy\\music\\fz69lse1soxmfnqh-lmy.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.376] GetFileType (hFile=0x260) returned 0x1 [0074.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0074.376] GetFileType (hFile=0x260) returned 0x1 [0074.376] WriteFile (in: hFile=0x260, lpBuffer=0x2f67e8c*, nNumberOfBytesToWrite=0x81b0, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f67e8c*, lpNumberOfBytesWritten=0xefecdc*=0x81b0, lpOverlapped=0x0) returned 1 [0074.378] CloseHandle (hObject=0x260) returned 1 [0074.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav", lpFilePart=0x0) returned 0x2e [0074.379] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav.wholocked", lpFilePart=0x0) returned 0x38 [0074.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0074.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav" (normalized: "c:\\users\\fd1hvy\\music\\fz69lse1soxmfnqh-lmy.wav"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92f1ae0, ftCreationTime.dwHighDateTime=0x1d5e600, ftLastAccessTime.dwLowDateTime=0xfe9aa550, ftLastAccessTime.dwHighDateTime=0x1d5e8b5, ftLastWriteTime.dwLowDateTime=0x4dbdc113, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x81b0)) returned 1 [0074.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0074.379] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav" (normalized: "c:\\users\\fd1hvy\\music\\fz69lse1soxmfnqh-lmy.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\fz69LSe1soXmFNQH-lmy.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fz69lse1soxmfnqh-lmy.wav.wholocked")) returned 1 [0074.380] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", lpFilePart=0x0) returned 0x28 [0074.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0074.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uchngbcejfjmgu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.380] GetFileType (hFile=0x260) returned 0x1 [0074.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.380] GetFileType (hFile=0x260) returned 0x1 [0074.380] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x6e80 [0074.381] ReadFile (in: hFile=0x260, lpBuffer=0x2f703c4, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2f703c4*, lpNumberOfBytesRead=0xefece8*=0x6e80, lpOverlapped=0x0) returned 1 [0074.381] CloseHandle (hObject=0x260) returned 1 [0074.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", lpFilePart=0x0) returned 0x28 [0074.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0074.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uchngbcejfjmgu.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.448] GetFileType (hFile=0x260) returned 0x1 [0074.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0074.448] GetFileType (hFile=0x260) returned 0x1 [0074.448] WriteFile (in: hFile=0x260, lpBuffer=0x2fdfa7c*, nNumberOfBytesToWrite=0x6e90, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2fdfa7c*, lpNumberOfBytesWritten=0xefecdc*=0x6e90, lpOverlapped=0x0) returned 1 [0074.450] CloseHandle (hObject=0x260) returned 1 [0074.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3", lpFilePart=0x0) returned 0x28 [0074.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3.wholocked", lpFilePart=0x0) returned 0x32 [0074.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0074.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uchngbcejfjmgu.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b2950, ftCreationTime.dwHighDateTime=0x1d5eb2b, ftLastAccessTime.dwLowDateTime=0xf5877690, ftLastAccessTime.dwHighDateTime=0x1d5f03b, ftLastWriteTime.dwLowDateTime=0x4dc9ace3, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6e90)) returned 1 [0074.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0074.451] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uchngbcejfjmgu.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\uCHNgbcEJfjMGu.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\uchngbcejfjmgu.mp3.wholocked")) returned 1 [0074.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", lpFilePart=0x0) returned 0x21 [0074.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0074.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\vuf9cnx.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.452] GetFileType (hFile=0x260) returned 0x1 [0074.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.452] GetFileType (hFile=0x260) returned 0x1 [0074.452] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xf961 [0074.452] ReadFile (in: hFile=0x260, lpBuffer=0x2fe6c38, nNumberOfBytesToRead=0xf961, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2fe6c38*, lpNumberOfBytesRead=0xefece8*=0xf961, lpOverlapped=0x0) returned 1 [0074.453] CloseHandle (hObject=0x260) returned 1 [0074.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", lpFilePart=0x0) returned 0x21 [0074.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0074.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\vuf9cnx.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.551] GetFileType (hFile=0x260) returned 0x1 [0074.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0074.551] GetFileType (hFile=0x260) returned 0x1 [0074.551] WriteFile (in: hFile=0x260, lpBuffer=0x2e34e0c*, nNumberOfBytesToWrite=0xf970, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e34e0c*, lpNumberOfBytesWritten=0xefecdc*=0xf970, lpOverlapped=0x0) returned 1 [0074.553] CloseHandle (hObject=0x260) returned 1 [0074.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a", lpFilePart=0x0) returned 0x21 [0074.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a.wholocked", lpFilePart=0x0) returned 0x2b [0074.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0074.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\vuf9cnx.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba765c60, ftCreationTime.dwHighDateTime=0x1d5e56e, ftLastAccessTime.dwLowDateTime=0x654be9b0, ftLastAccessTime.dwHighDateTime=0x1d5ee17, ftLastWriteTime.dwLowDateTime=0x4dd7fc27, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xf970)) returned 1 [0074.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0074.555] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a" (normalized: "c:\\users\\fd1hvy\\music\\vuf9cnx.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\vUf9cNx.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\vuf9cnx.m4a.wholocked")) returned 1 [0074.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0074.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6", lpFilePart=0x0) returned 0x1b [0074.555] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd1d8 [0074.556] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b82d9e0, ftCreationTime.dwHighDateTime=0x1d5ef9a, ftLastAccessTime.dwLowDateTime=0xa39b1e50, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0xa39b1e50, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x6faa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyrDwAJKHwmF6k.m4a", cAlternateFileName="IYRDWA~1.M4A")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca01e060, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0x6e18e20, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x6e18e20, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0xc21a, dwReserved0=0x0, dwReserved1=0x0, cFileName="th8DNgR_0PX.m4a", cAlternateFileName="TH8DNG~1.M4A")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTBqTmD", cAlternateFileName="")) returned 1 [0074.556] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc4a800, ftCreationTime.dwHighDateTime=0x1d5e62b, ftLastAccessTime.dwLowDateTime=0x8a2a1a90, ftLastAccessTime.dwHighDateTime=0x1d5eb6f, ftLastWriteTime.dwLowDateTime=0x8a2a1a90, ftLastWriteTime.dwHighDateTime=0x1d5eb6f, nFileSizeHigh=0x0, nFileSizeLow=0xb1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="W1Q4qnu5_w4evmlOT_d.m4a", cAlternateFileName="W1Q4QN~1.M4A")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca9d40e0, ftCreationTime.dwHighDateTime=0x1d5e8ac, ftLastAccessTime.dwLowDateTime=0x96c517b0, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0x96c517b0, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0x5498, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkrU yK.wav", cAlternateFileName="XKRUYK~1.WAV")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x12cd1d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.557] FindClose (in: hFindFile=0x12cd1d8 | out: hFindFile=0x12cd1d8) returned 1 [0074.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0074.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0074.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0074.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6", lpFilePart=0x0) returned 0x1b [0074.557] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cced8 [0074.557] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b1286a0, ftCreationTime.dwHighDateTime=0x1d5e28d, ftLastAccessTime.dwLowDateTime=0x309e4260, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x309e4260, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b82d9e0, ftCreationTime.dwHighDateTime=0x1d5ef9a, ftLastAccessTime.dwLowDateTime=0xa39b1e50, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0xa39b1e50, ftLastWriteTime.dwHighDateTime=0x1d5e982, nFileSizeHigh=0x0, nFileSizeLow=0x6faa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iyrDwAJKHwmF6k.m4a", cAlternateFileName="IYRDWA~1.M4A")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca01e060, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0x6e18e20, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x6e18e20, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0xc21a, dwReserved0=0x0, dwReserved1=0x0, cFileName="th8DNgR_0PX.m4a", cAlternateFileName="TH8DNG~1.M4A")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTBqTmD", cAlternateFileName="")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc4a800, ftCreationTime.dwHighDateTime=0x1d5e62b, ftLastAccessTime.dwLowDateTime=0x8a2a1a90, ftLastAccessTime.dwHighDateTime=0x1d5eb6f, ftLastWriteTime.dwLowDateTime=0x8a2a1a90, ftLastWriteTime.dwHighDateTime=0x1d5eb6f, nFileSizeHigh=0x0, nFileSizeLow=0xb1ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="W1Q4qnu5_w4evmlOT_d.m4a", cAlternateFileName="W1Q4QN~1.M4A")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca9d40e0, ftCreationTime.dwHighDateTime=0x1d5e8ac, ftLastAccessTime.dwLowDateTime=0x96c517b0, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0x96c517b0, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0x5498, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkrU yK.wav", cAlternateFileName="XKRUYK~1.WAV")) returned 1 [0074.558] FindNextFileW (in: hFindFile=0x12cced8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca9d40e0, ftCreationTime.dwHighDateTime=0x1d5e8ac, ftLastAccessTime.dwLowDateTime=0x96c517b0, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0x96c517b0, ftLastWriteTime.dwHighDateTime=0x1d5e632, nFileSizeHigh=0x0, nFileSizeLow=0x5498, dwReserved0=0x0, dwReserved1=0x0, cFileName="xkrU yK.wav", cAlternateFileName="XKRUYK~1.WAV")) returned 0 [0074.559] FindClose (in: hFindFile=0x12cced8 | out: hFindFile=0x12cced8) returned 1 [0074.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0074.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0074.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", lpFilePart=0x0) returned 0x2e [0074.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0074.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\iyrdwajkhwmf6k.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.559] GetFileType (hFile=0x260) returned 0x1 [0074.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0074.559] GetFileType (hFile=0x260) returned 0x1 [0074.559] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x6faa [0074.559] ReadFile (in: hFile=0x260, lpBuffer=0x2e464c4, nNumberOfBytesToRead=0x6faa, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2e464c4*, lpNumberOfBytesRead=0xefec60*=0x6faa, lpOverlapped=0x0) returned 1 [0074.560] CloseHandle (hObject=0x260) returned 1 [0074.652] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", lpFilePart=0x0) returned 0x2e [0074.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0074.652] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\iyrdwajkhwmf6k.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.653] GetFileType (hFile=0x260) returned 0x1 [0074.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0074.653] GetFileType (hFile=0x260) returned 0x1 [0074.653] WriteFile (in: hFile=0x260, lpBuffer=0x2eb627c*, nNumberOfBytesToWrite=0x6fb0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2eb627c*, lpNumberOfBytesWritten=0xefec54*=0x6fb0, lpOverlapped=0x0) returned 1 [0074.654] CloseHandle (hObject=0x260) returned 1 [0074.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a", lpFilePart=0x0) returned 0x2e [0074.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a.wholocked", lpFilePart=0x0) returned 0x38 [0074.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0074.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\iyrdwajkhwmf6k.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b82d9e0, ftCreationTime.dwHighDateTime=0x1d5ef9a, ftLastAccessTime.dwLowDateTime=0xa39b1e50, ftLastAccessTime.dwHighDateTime=0x1d5e982, ftLastWriteTime.dwLowDateTime=0x4de8ac8e, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6fb0)) returned 1 [0074.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0074.656] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\iyrdwajkhwmf6k.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\iyrDwAJKHwmF6k.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\iyrdwajkhwmf6k.m4a.wholocked")) returned 1 [0074.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", lpFilePart=0x0) returned 0x2b [0074.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0074.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\th8dngr_0px.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.657] GetFileType (hFile=0x260) returned 0x1 [0074.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0074.657] GetFileType (hFile=0x260) returned 0x1 [0074.657] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xc21a [0074.657] ReadFile (in: hFile=0x260, lpBuffer=0x2ebd5a4, nNumberOfBytesToRead=0xc21a, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2ebd5a4*, lpNumberOfBytesRead=0xefec60*=0xc21a, lpOverlapped=0x0) returned 1 [0074.657] CloseHandle (hObject=0x260) returned 1 [0074.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", lpFilePart=0x0) returned 0x2b [0074.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0074.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\th8dngr_0px.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.722] GetFileType (hFile=0x260) returned 0x1 [0074.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0074.722] GetFileType (hFile=0x260) returned 0x1 [0074.722] WriteFile (in: hFile=0x260, lpBuffer=0x2f2ea04*, nNumberOfBytesToWrite=0xc220, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f2ea04*, lpNumberOfBytesWritten=0xefec54*=0xc220, lpOverlapped=0x0) returned 1 [0074.724] CloseHandle (hObject=0x260) returned 1 [0074.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a", lpFilePart=0x0) returned 0x2b [0074.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a.wholocked", lpFilePart=0x0) returned 0x35 [0074.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0074.726] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\th8dngr_0px.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca01e060, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0x6e18e20, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x4df234cc, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xc220)) returned 1 [0074.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0074.726] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\th8dngr_0px.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\th8DNgR_0PX.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\th8dngr_0px.m4a.wholocked")) returned 1 [0074.726] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", lpFilePart=0x0) returned 0x33 [0074.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0074.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\w1q4qnu5_w4evmlot_d.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.726] GetFileType (hFile=0x260) returned 0x1 [0074.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0074.726] GetFileType (hFile=0x260) returned 0x1 [0074.726] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xb1ea [0074.727] ReadFile (in: hFile=0x260, lpBuffer=0x2f3af94, nNumberOfBytesToRead=0xb1ea, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f3af94*, lpNumberOfBytesRead=0xefec60*=0xb1ea, lpOverlapped=0x0) returned 1 [0074.727] CloseHandle (hObject=0x260) returned 1 [0074.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", lpFilePart=0x0) returned 0x33 [0074.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0074.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\w1q4qnu5_w4evmlot_d.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.744] GetFileType (hFile=0x260) returned 0x1 [0074.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0074.744] GetFileType (hFile=0x260) returned 0x1 [0074.745] WriteFile (in: hFile=0x260, lpBuffer=0x2fa9364*, nNumberOfBytesToWrite=0xb1f0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fa9364*, lpNumberOfBytesWritten=0xefec54*=0xb1f0, lpOverlapped=0x0) returned 1 [0074.746] CloseHandle (hObject=0x260) returned 1 [0074.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a", lpFilePart=0x0) returned 0x33 [0074.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a.wholocked", lpFilePart=0x0) returned 0x3d [0074.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0074.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\w1q4qnu5_w4evmlot_d.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc4a800, ftCreationTime.dwHighDateTime=0x1d5e62b, ftLastAccessTime.dwLowDateTime=0x8a2a1a90, ftLastAccessTime.dwHighDateTime=0x1d5eb6f, ftLastWriteTime.dwLowDateTime=0x4df6f989, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xb1f0)) returned 1 [0074.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0074.748] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\w1q4qnu5_w4evmlot_d.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\W1Q4qnu5_w4evmlOT_d.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\w1q4qnu5_w4evmlot_d.m4a.wholocked")) returned 1 [0074.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", lpFilePart=0x0) returned 0x27 [0074.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0074.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\xkru yk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.749] GetFileType (hFile=0x260) returned 0x1 [0074.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0074.749] GetFileType (hFile=0x260) returned 0x1 [0074.749] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x5498 [0074.749] ReadFile (in: hFile=0x260, lpBuffer=0x2fb48e4, nNumberOfBytesToRead=0x5498, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2fb48e4*, lpNumberOfBytesRead=0xefec60*=0x5498, lpOverlapped=0x0) returned 1 [0074.749] CloseHandle (hObject=0x260) returned 1 [0074.843] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", lpFilePart=0x0) returned 0x27 [0074.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0074.843] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\xkru yk.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.844] GetFileType (hFile=0x260) returned 0x1 [0074.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0074.844] GetFileType (hFile=0x260) returned 0x1 [0074.844] WriteFile (in: hFile=0x260, lpBuffer=0x2e21ec0*, nNumberOfBytesToWrite=0x54a0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e21ec0*, lpNumberOfBytesWritten=0xefec54*=0x54a0, lpOverlapped=0x0) returned 1 [0074.845] CloseHandle (hObject=0x260) returned 1 [0074.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav", lpFilePart=0x0) returned 0x27 [0074.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav.wholocked", lpFilePart=0x0) returned 0x31 [0074.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0074.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\xkru yk.wav"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca9d40e0, ftCreationTime.dwHighDateTime=0x1d5e8ac, ftLastAccessTime.dwLowDateTime=0x96c517b0, ftLastAccessTime.dwHighDateTime=0x1d5e632, ftLastWriteTime.dwLowDateTime=0x4e054800, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x54a0)) returned 1 [0074.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0074.847] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\xkru yk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\xkrU yK.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\xkru yk.wav.wholocked")) returned 1 [0074.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0074.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD", lpFilePart=0x0) returned 0x23 [0074.848] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccf18 [0074.848] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.848] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b34ddc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x964947a0, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x964947a0, ftLastWriteTime.dwHighDateTime=0x1d5e427, nFileSizeHigh=0x0, nFileSizeLow=0x16d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0MJgO F9dE9EU vZ dK.wav", cAlternateFileName="0MJGOF~1.WAV")) returned 1 [0074.848] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0a900, ftCreationTime.dwHighDateTime=0x1d5e607, ftLastAccessTime.dwLowDateTime=0xa1677c30, ftLastAccessTime.dwHighDateTime=0x1d5e9d4, ftLastWriteTime.dwLowDateTime=0xa1677c30, ftLastWriteTime.dwHighDateTime=0x1d5e9d4, nFileSizeHigh=0x0, nFileSizeLow=0x397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8my_MQolMPucJSi.mp3", cAlternateFileName="8MY_MQ~1.MP3")) returned 1 [0074.848] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc23800, ftCreationTime.dwHighDateTime=0x1d5e9f8, ftLastAccessTime.dwLowDateTime=0x97562690, ftLastAccessTime.dwHighDateTime=0x1d5e652, ftLastWriteTime.dwLowDateTime=0x97562690, ftLastWriteTime.dwHighDateTime=0x1d5e652, nFileSizeHigh=0x0, nFileSizeLow=0xe633, dwReserved0=0x0, dwReserved1=0x0, cFileName="f2P unkdzohW-AE.mp3", cAlternateFileName="F2PUNK~1.MP3")) returned 1 [0074.848] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faaf70, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0xf4848200, ftLastAccessTime.dwHighDateTime=0x1d5ea47, ftLastWriteTime.dwLowDateTime=0xf4848200, ftLastWriteTime.dwHighDateTime=0x1d5ea47, nFileSizeHigh=0x0, nFileSizeLow=0xeb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LdsewroowTcWYnjJKt.wav", cAlternateFileName="LDSEWR~1.WAV")) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82082480, ftCreationTime.dwHighDateTime=0x1d5e87f, ftLastAccessTime.dwLowDateTime=0x11875910, ftLastAccessTime.dwHighDateTime=0x1d5e14a, ftLastWriteTime.dwLowDateTime=0x11875910, ftLastWriteTime.dwHighDateTime=0x1d5e14a, nFileSizeHigh=0x0, nFileSizeLow=0x84b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4vVxkV0s.wav", cAlternateFileName="V4VVXK~1.WAV")) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4da30, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xf36f9b70, ftLastAccessTime.dwHighDateTime=0x1d5e669, ftLastWriteTime.dwLowDateTime=0xf36f9b70, ftLastWriteTime.dwHighDateTime=0x1d5e669, nFileSizeHigh=0x0, nFileSizeLow=0xf145, dwReserved0=0x0, dwReserved1=0x0, cFileName="XqdaLXF3uvEoLJz.mp3", cAlternateFileName="XQDALX~1.MP3")) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.849] FindClose (in: hFindFile=0x12ccf18 | out: hFindFile=0x12ccf18) returned 1 [0074.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0074.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0074.849] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD", lpFilePart=0x0) returned 0x23 [0074.849] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccc18 [0074.849] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42400ae0, ftCreationTime.dwHighDateTime=0x1d5efda, ftLastAccessTime.dwLowDateTime=0x4f889990, ftLastAccessTime.dwHighDateTime=0x1d5eaff, ftLastWriteTime.dwLowDateTime=0x4f889990, ftLastWriteTime.dwHighDateTime=0x1d5eaff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b34ddc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x964947a0, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x964947a0, ftLastWriteTime.dwHighDateTime=0x1d5e427, nFileSizeHigh=0x0, nFileSizeLow=0x16d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0MJgO F9dE9EU vZ dK.wav", cAlternateFileName="0MJGOF~1.WAV")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0a900, ftCreationTime.dwHighDateTime=0x1d5e607, ftLastAccessTime.dwLowDateTime=0xa1677c30, ftLastAccessTime.dwHighDateTime=0x1d5e9d4, ftLastWriteTime.dwLowDateTime=0xa1677c30, ftLastWriteTime.dwHighDateTime=0x1d5e9d4, nFileSizeHigh=0x0, nFileSizeLow=0x397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8my_MQolMPucJSi.mp3", cAlternateFileName="8MY_MQ~1.MP3")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc23800, ftCreationTime.dwHighDateTime=0x1d5e9f8, ftLastAccessTime.dwLowDateTime=0x97562690, ftLastAccessTime.dwHighDateTime=0x1d5e652, ftLastWriteTime.dwLowDateTime=0x97562690, ftLastWriteTime.dwHighDateTime=0x1d5e652, nFileSizeHigh=0x0, nFileSizeLow=0xe633, dwReserved0=0x0, dwReserved1=0x0, cFileName="f2P unkdzohW-AE.mp3", cAlternateFileName="F2PUNK~1.MP3")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faaf70, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0xf4848200, ftLastAccessTime.dwHighDateTime=0x1d5ea47, ftLastWriteTime.dwLowDateTime=0xf4848200, ftLastWriteTime.dwHighDateTime=0x1d5ea47, nFileSizeHigh=0x0, nFileSizeLow=0xeb28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LdsewroowTcWYnjJKt.wav", cAlternateFileName="LDSEWR~1.WAV")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82082480, ftCreationTime.dwHighDateTime=0x1d5e87f, ftLastAccessTime.dwLowDateTime=0x11875910, ftLastAccessTime.dwHighDateTime=0x1d5e14a, ftLastWriteTime.dwLowDateTime=0x11875910, ftLastWriteTime.dwHighDateTime=0x1d5e14a, nFileSizeHigh=0x0, nFileSizeLow=0x84b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4vVxkV0s.wav", cAlternateFileName="V4VVXK~1.WAV")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4da30, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xf36f9b70, ftLastAccessTime.dwHighDateTime=0x1d5e669, ftLastWriteTime.dwLowDateTime=0xf36f9b70, ftLastWriteTime.dwHighDateTime=0x1d5e669, nFileSizeHigh=0x0, nFileSizeLow=0xf145, dwReserved0=0x0, dwReserved1=0x0, cFileName="XqdaLXF3uvEoLJz.mp3", cAlternateFileName="XQDALX~1.MP3")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4da30, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xf36f9b70, ftLastAccessTime.dwHighDateTime=0x1d5e669, ftLastWriteTime.dwLowDateTime=0xf36f9b70, ftLastWriteTime.dwHighDateTime=0x1d5e669, nFileSizeHigh=0x0, nFileSizeLow=0xf145, dwReserved0=0x0, dwReserved1=0x0, cFileName="XqdaLXF3uvEoLJz.mp3", cAlternateFileName="XQDALX~1.MP3")) returned 0 [0074.850] FindClose (in: hFindFile=0x12ccc18 | out: hFindFile=0x12ccc18) returned 1 [0074.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0074.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0074.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", lpFilePart=0x0) returned 0x3c [0074.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0074.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\0mjgo f9de9eu vz dk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.851] GetFileType (hFile=0x260) returned 0x1 [0074.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0074.851] GetFileType (hFile=0x260) returned 0x1 [0074.851] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x16d5d [0074.852] ReadFile (in: hFile=0x260, lpBuffer=0x3ec0668, nNumberOfBytesToRead=0x16d5d, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x3ec0668*, lpNumberOfBytesRead=0xefebd8*=0x16d5d, lpOverlapped=0x0) returned 1 [0074.853] CloseHandle (hObject=0x260) returned 1 [0074.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", lpFilePart=0x0) returned 0x3c [0074.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0074.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\0mjgo f9de9eu vz dk.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.924] GetFileType (hFile=0x260) returned 0x1 [0074.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0074.924] GetFileType (hFile=0x260) returned 0x1 [0074.924] WriteFile (in: hFile=0x260, lpBuffer=0x3f32988*, nNumberOfBytesToWrite=0x16d60, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3f32988*, lpNumberOfBytesWritten=0xefebcc*=0x16d60, lpOverlapped=0x0) returned 1 [0074.926] CloseHandle (hObject=0x260) returned 1 [0074.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav", lpFilePart=0x0) returned 0x3c [0074.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav.wholocked", lpFilePart=0x0) returned 0x46 [0074.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0074.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\0mjgo f9de9eu vz dk.wav"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b34ddc0, ftCreationTime.dwHighDateTime=0x1d5e647, ftLastAccessTime.dwLowDateTime=0x964947a0, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x4e113382, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x16d60)) returned 1 [0074.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0074.930] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\0mjgo f9de9eu vz dk.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\0MJgO F9dE9EU vZ dK.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\0mjgo f9de9eu vz dk.wav.wholocked")) returned 1 [0074.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", lpFilePart=0x0) returned 0x37 [0074.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0074.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\8my_mqolmpucjsi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.931] GetFileType (hFile=0x260) returned 0x1 [0074.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0074.931] GetFileType (hFile=0x260) returned 0x1 [0074.931] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x397e [0074.931] ReadFile (in: hFile=0x260, lpBuffer=0x2e76ba0, nNumberOfBytesToRead=0x397e, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e76ba0*, lpNumberOfBytesRead=0xefebd8*=0x397e, lpOverlapped=0x0) returned 1 [0074.931] CloseHandle (hObject=0x260) returned 1 [0074.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", lpFilePart=0x0) returned 0x37 [0074.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0074.946] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\8my_mqolmpucjsi.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.947] GetFileType (hFile=0x260) returned 0x1 [0074.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0074.947] GetFileType (hFile=0x260) returned 0x1 [0074.947] WriteFile (in: hFile=0x260, lpBuffer=0x2ed590c*, nNumberOfBytesToWrite=0x3980, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ed590c*, lpNumberOfBytesWritten=0xefebcc*=0x3980, lpOverlapped=0x0) returned 1 [0074.948] CloseHandle (hObject=0x260) returned 1 [0074.985] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3", lpFilePart=0x0) returned 0x37 [0074.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3.wholocked", lpFilePart=0x0) returned 0x41 [0074.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0074.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\8my_mqolmpucjsi.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95b0a900, ftCreationTime.dwHighDateTime=0x1d5e607, ftLastAccessTime.dwLowDateTime=0xa1677c30, ftLastAccessTime.dwHighDateTime=0x1d5e9d4, ftLastWriteTime.dwLowDateTime=0x4e1abae9, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3980)) returned 1 [0074.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0074.986] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\8my_mqolmpucjsi.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\8my_MQolMPucJSi.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\8my_mqolmpucjsi.mp3.wholocked")) returned 1 [0074.986] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", lpFilePart=0x0) returned 0x37 [0074.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0074.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\f2p unkdzohw-ae.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0074.987] GetFileType (hFile=0x260) returned 0x1 [0074.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0074.987] GetFileType (hFile=0x260) returned 0x1 [0074.987] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xe633 [0074.987] ReadFile (in: hFile=0x260, lpBuffer=0x2ed9664, nNumberOfBytesToRead=0xe633, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2ed9664*, lpNumberOfBytesRead=0xefebd8*=0xe633, lpOverlapped=0x0) returned 1 [0074.987] CloseHandle (hObject=0x260) returned 1 [0075.004] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", lpFilePart=0x0) returned 0x37 [0075.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0075.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\f2p unkdzohw-ae.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.005] GetFileType (hFile=0x260) returned 0x1 [0075.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0075.005] GetFileType (hFile=0x260) returned 0x1 [0075.005] WriteFile (in: hFile=0x260, lpBuffer=0x2f51724*, nNumberOfBytesToWrite=0xe640, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f51724*, lpNumberOfBytesWritten=0xefebcc*=0xe640, lpOverlapped=0x0) returned 1 [0075.007] CloseHandle (hObject=0x260) returned 1 [0075.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3", lpFilePart=0x0) returned 0x37 [0075.008] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3.wholocked", lpFilePart=0x0) returned 0x41 [0075.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0075.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\f2p unkdzohw-ae.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafc23800, ftCreationTime.dwHighDateTime=0x1d5e9f8, ftLastAccessTime.dwLowDateTime=0x97562690, ftLastAccessTime.dwHighDateTime=0x1d5e652, ftLastWriteTime.dwLowDateTime=0x4e1d1d49, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xe640)) returned 1 [0075.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0075.009] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\f2p unkdzohw-ae.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\f2P unkdzohW-AE.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\f2p unkdzohw-ae.mp3.wholocked")) returned 1 [0075.009] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", lpFilePart=0x0) returned 0x3a [0075.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0075.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\ldsewroowtcwynjjkt.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.009] GetFileType (hFile=0x260) returned 0x1 [0075.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0075.009] GetFileType (hFile=0x260) returned 0x1 [0075.009] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xeb28 [0075.010] ReadFile (in: hFile=0x260, lpBuffer=0x2f6014c, nNumberOfBytesToRead=0xeb28, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f6014c*, lpNumberOfBytesRead=0xefebd8*=0xeb28, lpOverlapped=0x0) returned 1 [0075.010] CloseHandle (hObject=0x260) returned 1 [0075.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", lpFilePart=0x0) returned 0x3a [0075.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0075.075] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\ldsewroowtcwynjjkt.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.076] GetFileType (hFile=0x260) returned 0x1 [0075.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0075.076] GetFileType (hFile=0x260) returned 0x1 [0075.076] WriteFile (in: hFile=0x260, lpBuffer=0x2fd90d8*, nNumberOfBytesToWrite=0xeb30, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2fd90d8*, lpNumberOfBytesWritten=0xefebcc*=0xeb30, lpOverlapped=0x0) returned 1 [0075.078] CloseHandle (hObject=0x260) returned 1 [0075.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav", lpFilePart=0x0) returned 0x3a [0075.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav.wholocked", lpFilePart=0x0) returned 0x44 [0075.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0075.080] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\ldsewroowtcwynjjkt.wav"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faaf70, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0xf4848200, ftLastAccessTime.dwHighDateTime=0x1d5ea47, ftLastWriteTime.dwLowDateTime=0x4e290991, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xeb30)) returned 1 [0075.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0075.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\ldsewroowtcwynjjkt.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\LdsewroowTcWYnjJKt.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\ldsewroowtcwynjjkt.wav.wholocked")) returned 1 [0075.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", lpFilePart=0x0) returned 0x31 [0075.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0075.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\v4vvxkv0s.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.081] GetFileType (hFile=0x260) returned 0x1 [0075.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0075.081] GetFileType (hFile=0x260) returned 0x1 [0075.081] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x84b2 [0075.081] ReadFile (in: hFile=0x260, lpBuffer=0x2fe7ff0, nNumberOfBytesToRead=0x84b2, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2fe7ff0*, lpNumberOfBytesRead=0xefebd8*=0x84b2, lpOverlapped=0x0) returned 1 [0075.081] CloseHandle (hObject=0x260) returned 1 [0075.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", lpFilePart=0x0) returned 0x31 [0075.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0075.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\v4vvxkv0s.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.177] GetFileType (hFile=0x260) returned 0x1 [0075.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0075.177] GetFileType (hFile=0x260) returned 0x1 [0075.177] WriteFile (in: hFile=0x260, lpBuffer=0x2e61c5c*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e61c5c*, lpNumberOfBytesWritten=0xefebcc*=0x84c0, lpOverlapped=0x0) returned 1 [0075.179] CloseHandle (hObject=0x260) returned 1 [0075.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav", lpFilePart=0x0) returned 0x31 [0075.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav.wholocked", lpFilePart=0x0) returned 0x3b [0075.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0075.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\v4vvxkv0s.wav"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82082480, ftCreationTime.dwHighDateTime=0x1d5e87f, ftLastAccessTime.dwLowDateTime=0x11875910, ftLastAccessTime.dwHighDateTime=0x1d5e14a, ftLastWriteTime.dwLowDateTime=0x4e3759f2, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x84c0)) returned 1 [0075.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0075.181] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\v4vvxkv0s.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\v4vVxkV0s.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\v4vvxkv0s.wav.wholocked")) returned 1 [0075.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", lpFilePart=0x0) returned 0x37 [0075.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0075.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\xqdalxf3uveoljz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.181] GetFileType (hFile=0x260) returned 0x1 [0075.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0075.181] GetFileType (hFile=0x260) returned 0x1 [0075.181] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xf145 [0075.181] ReadFile (in: hFile=0x260, lpBuffer=0x2e6a4b8, nNumberOfBytesToRead=0xf145, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e6a4b8*, lpNumberOfBytesRead=0xefebd8*=0xf145, lpOverlapped=0x0) returned 1 [0075.182] CloseHandle (hObject=0x260) returned 1 [0075.326] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", lpFilePart=0x0) returned 0x37 [0075.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0075.326] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\xqdalxf3uveoljz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.327] GetFileType (hFile=0x260) returned 0x1 [0075.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0075.327] GetFileType (hFile=0x260) returned 0x1 [0075.327] WriteFile (in: hFile=0x260, lpBuffer=0x2ee4804*, nNumberOfBytesToWrite=0xf150, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ee4804*, lpNumberOfBytesWritten=0xefebcc*=0xf150, lpOverlapped=0x0) returned 1 [0075.329] CloseHandle (hObject=0x260) returned 1 [0075.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3", lpFilePart=0x0) returned 0x37 [0075.331] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3.wholocked", lpFilePart=0x0) returned 0x41 [0075.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0075.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\xqdalxf3uveoljz.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a4da30, ftCreationTime.dwHighDateTime=0x1d5ebd0, ftLastAccessTime.dwLowDateTime=0xf36f9b70, ftLastAccessTime.dwHighDateTime=0x1d5e669, ftLastWriteTime.dwLowDateTime=0x4e4f30be, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xf150)) returned 1 [0075.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0075.332] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\xqdalxf3uveoljz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\biZK6\\TTBqTmD\\XqdaLXF3uvEoLJz.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\bizk6\\ttbqtmd\\xqdalxf3uveoljz.mp3.wholocked")) returned 1 [0075.332] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0075.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0075.332] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.333] GetFileType (hFile=0x260) returned 0x1 [0075.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0075.333] GetFileType (hFile=0x260) returned 0x1 [0075.333] WriteFile (in: hFile=0x260, lpBuffer=0x2ef5740*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ef5740*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0075.334] CloseHandle (hObject=0x260) returned 1 [0075.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0075.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.335] GetFileType (hFile=0x260) returned 0x1 [0075.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0075.336] GetFileType (hFile=0x260) returned 0x1 [0075.336] WriteFile (in: hFile=0x260, lpBuffer=0x2ef828c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ef828c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0075.337] CloseHandle (hObject=0x260) returned 1 [0075.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0075.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.338] GetFileType (hFile=0x260) returned 0x1 [0075.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0075.338] GetFileType (hFile=0x260) returned 0x1 [0075.338] WriteFile (in: hFile=0x260, lpBuffer=0x2efadd8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2efadd8*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0075.339] CloseHandle (hObject=0x260) returned 1 [0075.434] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0075.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0075.434] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.435] GetFileType (hFile=0x260) returned 0x1 [0075.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0075.435] GetFileType (hFile=0x260) returned 0x1 [0075.435] WriteFile (in: hFile=0x260, lpBuffer=0x2efd924*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2efd924*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0075.436] CloseHandle (hObject=0x260) returned 1 [0075.436] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0075.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0075.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.437] GetFileType (hFile=0x260) returned 0x1 [0075.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0075.437] GetFileType (hFile=0x260) returned 0x1 [0075.438] WriteFile (in: hFile=0x260, lpBuffer=0x2f00468*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f00468*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0075.438] CloseHandle (hObject=0x260) returned 1 [0075.439] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0075.439] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.439] GetFileType (hFile=0x260) returned 0x1 [0075.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0075.439] GetFileType (hFile=0x260) returned 0x1 [0075.440] WriteFile (in: hFile=0x260, lpBuffer=0x2f02fb4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f02fb4*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0075.440] CloseHandle (hObject=0x260) returned 1 [0075.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0075.443] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.444] GetFileType (hFile=0x260) returned 0x1 [0075.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0075.444] GetFileType (hFile=0x260) returned 0x1 [0075.444] WriteFile (in: hFile=0x260, lpBuffer=0x2f05b00*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f05b00*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0075.445] CloseHandle (hObject=0x260) returned 1 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0075.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0075.445] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.446] GetFileType (hFile=0x260) returned 0x1 [0075.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0075.446] GetFileType (hFile=0x260) returned 0x1 [0075.446] WriteFile (in: hFile=0x260, lpBuffer=0x2f0864c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f0864c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0075.447] CloseHandle (hObject=0x260) returned 1 [0075.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0075.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV", lpFilePart=0x0) returned 0x1d [0075.447] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd258 [0075.448] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.448] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmxhiEn_ c4SIAn5Wn", cAlternateFileName="AMXHIE~1")) returned 1 [0075.448] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2433d10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0x25937000, ftLastAccessTime.dwHighDateTime=0x1d5e907, ftLastWriteTime.dwLowDateTime=0x25937000, ftLastWriteTime.dwHighDateTime=0x1d5e907, nFileSizeHigh=0x0, nFileSizeLow=0x91c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iu8veS1id08eUsk-A.m4a", cAlternateFileName="IU8VES~1.M4A")) returned 1 [0075.448] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb1dca0, ftCreationTime.dwHighDateTime=0x1d5ee14, ftLastAccessTime.dwLowDateTime=0xa3c36b70, ftLastAccessTime.dwHighDateTime=0x1d5eb72, ftLastWriteTime.dwLowDateTime=0xa3c36b70, ftLastWriteTime.dwHighDateTime=0x1d5eb72, nFileSizeHigh=0x0, nFileSizeLow=0x3510, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbD8zdkZ_aG.wav", cAlternateFileName="MBD8ZD~1.WAV")) returned 1 [0075.448] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87e6d60, ftCreationTime.dwHighDateTime=0x1d5e41d, ftLastAccessTime.dwLowDateTime=0x63ff8c50, ftLastAccessTime.dwHighDateTime=0x1d5ec92, ftLastWriteTime.dwLowDateTime=0x63ff8c50, ftLastWriteTime.dwHighDateTime=0x1d5ec92, nFileSizeHigh=0x0, nFileSizeLow=0x13d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="uzbfS9V.m4a", cAlternateFileName="")) returned 1 [0075.449] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.449] FindClose (in: hFindFile=0x12cd258 | out: hFindFile=0x12cd258) returned 1 [0075.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0075.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0075.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0075.449] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV", lpFilePart=0x0) returned 0x1d [0075.449] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd018 [0075.449] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99c621a0, ftCreationTime.dwHighDateTime=0x1d5e21f, ftLastAccessTime.dwLowDateTime=0x4b859e50, ftLastAccessTime.dwHighDateTime=0x1d5ee75, ftLastWriteTime.dwLowDateTime=0x4b859e50, ftLastWriteTime.dwHighDateTime=0x1d5ee75, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.449] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AmxhiEn_ c4SIAn5Wn", cAlternateFileName="AMXHIE~1")) returned 1 [0075.449] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2433d10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0x25937000, ftLastAccessTime.dwHighDateTime=0x1d5e907, ftLastWriteTime.dwLowDateTime=0x25937000, ftLastWriteTime.dwHighDateTime=0x1d5e907, nFileSizeHigh=0x0, nFileSizeLow=0x91c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iu8veS1id08eUsk-A.m4a", cAlternateFileName="IU8VES~1.M4A")) returned 1 [0075.450] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb1dca0, ftCreationTime.dwHighDateTime=0x1d5ee14, ftLastAccessTime.dwLowDateTime=0xa3c36b70, ftLastAccessTime.dwHighDateTime=0x1d5eb72, ftLastWriteTime.dwLowDateTime=0xa3c36b70, ftLastWriteTime.dwHighDateTime=0x1d5eb72, nFileSizeHigh=0x0, nFileSizeLow=0x3510, dwReserved0=0x0, dwReserved1=0x0, cFileName="mbD8zdkZ_aG.wav", cAlternateFileName="MBD8ZD~1.WAV")) returned 1 [0075.450] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87e6d60, ftCreationTime.dwHighDateTime=0x1d5e41d, ftLastAccessTime.dwLowDateTime=0x63ff8c50, ftLastAccessTime.dwHighDateTime=0x1d5ec92, ftLastWriteTime.dwLowDateTime=0x63ff8c50, ftLastWriteTime.dwHighDateTime=0x1d5ec92, nFileSizeHigh=0x0, nFileSizeLow=0x13d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="uzbfS9V.m4a", cAlternateFileName="")) returned 1 [0075.450] FindNextFileW (in: hFindFile=0x12cd018, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87e6d60, ftCreationTime.dwHighDateTime=0x1d5e41d, ftLastAccessTime.dwLowDateTime=0x63ff8c50, ftLastAccessTime.dwHighDateTime=0x1d5ec92, ftLastWriteTime.dwLowDateTime=0x63ff8c50, ftLastWriteTime.dwHighDateTime=0x1d5ec92, nFileSizeHigh=0x0, nFileSizeLow=0x13d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="uzbfS9V.m4a", cAlternateFileName="")) returned 0 [0075.450] FindClose (in: hFindFile=0x12cd018 | out: hFindFile=0x12cd018) returned 1 [0075.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0075.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0075.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", lpFilePart=0x0) returned 0x33 [0075.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0075.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\iu8ves1id08eusk-a.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.450] GetFileType (hFile=0x260) returned 0x1 [0075.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.450] GetFileType (hFile=0x260) returned 0x1 [0075.450] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x91c0 [0075.451] ReadFile (in: hFile=0x260, lpBuffer=0x2f0afc0, nNumberOfBytesToRead=0x91c0, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f0afc0*, lpNumberOfBytesRead=0xefec60*=0x91c0, lpOverlapped=0x0) returned 1 [0075.451] CloseHandle (hObject=0x260) returned 1 [0075.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", lpFilePart=0x0) returned 0x33 [0075.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0075.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\iu8ves1id08eusk-a.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.467] GetFileType (hFile=0x260) returned 0x1 [0075.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0075.468] GetFileType (hFile=0x260) returned 0x1 [0075.468] WriteFile (in: hFile=0x260, lpBuffer=0x2f856b8*, nNumberOfBytesToWrite=0x91d0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f856b8*, lpNumberOfBytesWritten=0xefec54*=0x91d0, lpOverlapped=0x0) returned 1 [0075.469] CloseHandle (hObject=0x260) returned 1 [0075.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a", lpFilePart=0x0) returned 0x33 [0075.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a.wholocked", lpFilePart=0x0) returned 0x3d [0075.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0075.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\iu8ves1id08eusk-a.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2433d10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0x25937000, ftLastAccessTime.dwHighDateTime=0x1d5e907, ftLastWriteTime.dwLowDateTime=0x4e64a62c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x91d0)) returned 1 [0075.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0075.471] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\iu8ves1id08eusk-a.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\Iu8veS1id08eUsk-A.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\iu8ves1id08eusk-a.m4a.wholocked")) returned 1 [0075.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", lpFilePart=0x0) returned 0x2d [0075.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0075.472] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\mbd8zdkz_ag.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.472] GetFileType (hFile=0x260) returned 0x1 [0075.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.472] GetFileType (hFile=0x260) returned 0x1 [0075.472] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x3510 [0075.472] ReadFile (in: hFile=0x260, lpBuffer=0x2f8ec28, nNumberOfBytesToRead=0x3510, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f8ec28*, lpNumberOfBytesRead=0xefec60*=0x3510, lpOverlapped=0x0) returned 1 [0075.472] CloseHandle (hObject=0x260) returned 1 [0075.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", lpFilePart=0x0) returned 0x2d [0075.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0075.537] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\mbd8zdkz_ag.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.538] GetFileType (hFile=0x260) returned 0x1 [0075.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0075.538] GetFileType (hFile=0x260) returned 0x1 [0075.538] WriteFile (in: hFile=0x260, lpBuffer=0x2fec3b0*, nNumberOfBytesToWrite=0x3520, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fec3b0*, lpNumberOfBytesWritten=0xefec54*=0x3520, lpOverlapped=0x0) returned 1 [0075.539] CloseHandle (hObject=0x260) returned 1 [0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav", lpFilePart=0x0) returned 0x2d [0075.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav.wholocked", lpFilePart=0x0) returned 0x37 [0075.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0075.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\mbd8zdkz_ag.wav"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb1dca0, ftCreationTime.dwHighDateTime=0x1d5ee14, ftLastAccessTime.dwLowDateTime=0xa3c36b70, ftLastAccessTime.dwHighDateTime=0x1d5eb72, ftLastWriteTime.dwLowDateTime=0x4e6e2f69, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3520)) returned 1 [0075.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0075.541] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\mbd8zdkz_ag.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\mbD8zdkZ_aG.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\mbd8zdkz_ag.wav.wholocked")) returned 1 [0075.541] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", lpFilePart=0x0) returned 0x29 [0075.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0075.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\uzbfs9v.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.541] GetFileType (hFile=0x260) returned 0x1 [0075.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.541] GetFileType (hFile=0x260) returned 0x1 [0075.541] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x13d16 [0075.542] ReadFile (in: hFile=0x260, lpBuffer=0x2fefc24, nNumberOfBytesToRead=0x13d16, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2fefc24*, lpNumberOfBytesRead=0xefec60*=0x13d16, lpOverlapped=0x0) returned 1 [0075.543] CloseHandle (hObject=0x260) returned 1 [0075.644] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", lpFilePart=0x0) returned 0x29 [0075.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0075.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\uzbfs9v.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.645] GetFileType (hFile=0x260) returned 0x1 [0075.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0075.645] GetFileType (hFile=0x260) returned 0x1 [0075.645] WriteFile (in: hFile=0x260, lpBuffer=0x2e832b4*, nNumberOfBytesToWrite=0x13d20, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e832b4*, lpNumberOfBytesWritten=0xefec54*=0x13d20, lpOverlapped=0x0) returned 1 [0075.647] CloseHandle (hObject=0x260) returned 1 [0075.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a", lpFilePart=0x0) returned 0x29 [0075.650] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a.wholocked", lpFilePart=0x0) returned 0x33 [0075.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0075.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\uzbfs9v.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87e6d60, ftCreationTime.dwHighDateTime=0x1d5e41d, ftLastAccessTime.dwLowDateTime=0x63ff8c50, ftLastAccessTime.dwHighDateTime=0x1d5ec92, ftLastWriteTime.dwLowDateTime=0x4e7ee132, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x13d20)) returned 1 [0075.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0075.650] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\uzbfs9v.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\uzbfS9V.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\uzbfs9v.m4a.wholocked")) returned 1 [0075.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0075.651] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn", lpFilePart=0x0) returned 0x30 [0075.651] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccc58 [0075.651] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.652] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cO59FIJkX5q", cAlternateFileName="CO59FI~1")) returned 1 [0075.652] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iVcTuVovm8xJflxDCFVw", cAlternateFileName="IVCTUV~1")) returned 1 [0075.652] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2272f20, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0xc25c6de0, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0xc25c6de0, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x1d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y2cSrl1XbUkB.m4a", cAlternateFileName="Y2CSRL~1.M4A")) returned 1 [0075.652] FindNextFileW (in: hFindFile=0x12ccc58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.652] FindClose (in: hFindFile=0x12ccc58 | out: hFindFile=0x12ccc58) returned 1 [0075.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0075.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0075.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0075.652] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn", lpFilePart=0x0) returned 0x30 [0075.652] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd258 [0075.653] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ce5fa00, ftCreationTime.dwHighDateTime=0x1d5f0ff, ftLastAccessTime.dwLowDateTime=0x8f445710, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x8f445710, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.653] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cO59FIJkX5q", cAlternateFileName="CO59FI~1")) returned 1 [0075.653] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iVcTuVovm8xJflxDCFVw", cAlternateFileName="IVCTUV~1")) returned 1 [0075.653] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2272f20, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0xc25c6de0, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0xc25c6de0, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x1d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y2cSrl1XbUkB.m4a", cAlternateFileName="Y2CSRL~1.M4A")) returned 1 [0075.653] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2272f20, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0xc25c6de0, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0xc25c6de0, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0x1d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y2cSrl1XbUkB.m4a", cAlternateFileName="Y2CSRL~1.M4A")) returned 0 [0075.653] FindClose (in: hFindFile=0x12cd258 | out: hFindFile=0x12cd258) returned 1 [0075.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0075.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0075.653] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", lpFilePart=0x0) returned 0x41 [0075.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0075.654] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\y2csrl1xbukb.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.654] GetFileType (hFile=0x260) returned 0x1 [0075.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0075.654] GetFileType (hFile=0x260) returned 0x1 [0075.654] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x1d62 [0075.654] ReadFile (in: hFile=0x260, lpBuffer=0x2e98e50, nNumberOfBytesToRead=0x1d62, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e98e50*, lpNumberOfBytesRead=0xefebd8*=0x1d62, lpOverlapped=0x0) returned 1 [0075.654] CloseHandle (hObject=0x260) returned 1 [0075.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", lpFilePart=0x0) returned 0x41 [0075.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0075.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\y2csrl1xbukb.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.717] GetFileType (hFile=0x260) returned 0x1 [0075.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0075.717] GetFileType (hFile=0x260) returned 0x1 [0075.717] WriteFile (in: hFile=0x260, lpBuffer=0x2eef0c8*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eef0c8*, lpNumberOfBytesWritten=0xefebcc*=0x1d70, lpOverlapped=0x0) returned 1 [0075.718] CloseHandle (hObject=0x260) returned 1 [0075.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a", lpFilePart=0x0) returned 0x41 [0075.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a.wholocked", lpFilePart=0x0) returned 0x4b [0075.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0075.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\y2csrl1xbukb.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2272f20, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0xc25c6de0, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x4e8acbab, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x1d70)) returned 1 [0075.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0075.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\y2csrl1xbukb.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\Y2cSrl1XbUkB.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\y2csrl1xbukb.m4a.wholocked")) returned 1 [0075.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0075.720] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q", lpFilePart=0x0) returned 0x3c [0075.720] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccb58 [0075.720] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.720] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bffe10, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xd0b59420, ftLastAccessTime.dwHighDateTime=0x1d5eee5, ftLastWriteTime.dwLowDateTime=0xd0b59420, ftLastWriteTime.dwHighDateTime=0x1d5eee5, nFileSizeHigh=0x0, nFileSizeLow=0x31f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbq4qjlZxk-qHl48vYm.m4a", cAlternateFileName="DBQ4QJ~1.M4A")) returned 1 [0075.720] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4adf10, ftCreationTime.dwHighDateTime=0x1d5ef3d, ftLastAccessTime.dwLowDateTime=0x50eaace0, ftLastAccessTime.dwHighDateTime=0x1d5e3f4, ftLastWriteTime.dwLowDateTime=0x50eaace0, ftLastWriteTime.dwHighDateTime=0x1d5e3f4, nFileSizeHigh=0x0, nFileSizeLow=0xa33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNk2.mp3", cAlternateFileName="")) returned 1 [0075.720] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad5e4c0, ftCreationTime.dwHighDateTime=0x1d5e9b7, ftLastAccessTime.dwLowDateTime=0xafaf7b30, ftLastAccessTime.dwHighDateTime=0x1d5e164, ftLastWriteTime.dwLowDateTime=0xafaf7b30, ftLastWriteTime.dwHighDateTime=0x1d5e164, nFileSizeHigh=0x0, nFileSizeLow=0x2a2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="V zTKMY3lgQ2.mp3", cAlternateFileName="VZTKMY~1.MP3")) returned 1 [0075.720] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6d7b50, ftCreationTime.dwHighDateTime=0x1d5effe, ftLastAccessTime.dwLowDateTime=0x999c8af0, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x999c8af0, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x737f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCgSvFAb3PV.wav", cAlternateFileName="VCGSVF~1.WAV")) returned 1 [0075.721] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.721] FindClose (in: hFindFile=0x12ccb58 | out: hFindFile=0x12ccb58) returned 1 [0075.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0075.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0075.721] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q", lpFilePart=0x0) returned 0x3c [0075.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccd98 [0075.721] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f9ff0, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x16791a10, ftLastAccessTime.dwHighDateTime=0x1d5e638, ftLastWriteTime.dwLowDateTime=0x16791a10, ftLastWriteTime.dwHighDateTime=0x1d5e638, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.721] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bffe10, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xd0b59420, ftLastAccessTime.dwHighDateTime=0x1d5eee5, ftLastWriteTime.dwLowDateTime=0xd0b59420, ftLastWriteTime.dwHighDateTime=0x1d5eee5, nFileSizeHigh=0x0, nFileSizeLow=0x31f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbq4qjlZxk-qHl48vYm.m4a", cAlternateFileName="DBQ4QJ~1.M4A")) returned 1 [0075.722] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4adf10, ftCreationTime.dwHighDateTime=0x1d5ef3d, ftLastAccessTime.dwLowDateTime=0x50eaace0, ftLastAccessTime.dwHighDateTime=0x1d5e3f4, ftLastWriteTime.dwLowDateTime=0x50eaace0, ftLastWriteTime.dwHighDateTime=0x1d5e3f4, nFileSizeHigh=0x0, nFileSizeLow=0xa33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNk2.mp3", cAlternateFileName="")) returned 1 [0075.722] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad5e4c0, ftCreationTime.dwHighDateTime=0x1d5e9b7, ftLastAccessTime.dwLowDateTime=0xafaf7b30, ftLastAccessTime.dwHighDateTime=0x1d5e164, ftLastWriteTime.dwLowDateTime=0xafaf7b30, ftLastWriteTime.dwHighDateTime=0x1d5e164, nFileSizeHigh=0x0, nFileSizeLow=0x2a2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="V zTKMY3lgQ2.mp3", cAlternateFileName="VZTKMY~1.MP3")) returned 1 [0075.722] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6d7b50, ftCreationTime.dwHighDateTime=0x1d5effe, ftLastAccessTime.dwLowDateTime=0x999c8af0, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x999c8af0, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x737f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCgSvFAb3PV.wav", cAlternateFileName="VCGSVF~1.WAV")) returned 1 [0075.722] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6d7b50, ftCreationTime.dwHighDateTime=0x1d5effe, ftLastAccessTime.dwLowDateTime=0x999c8af0, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x999c8af0, ftLastWriteTime.dwHighDateTime=0x1d5e41f, nFileSizeHigh=0x0, nFileSizeLow=0x737f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCgSvFAb3PV.wav", cAlternateFileName="VCGSVF~1.WAV")) returned 0 [0075.722] FindClose (in: hFindFile=0x12ccd98 | out: hFindFile=0x12ccd98) returned 1 [0075.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0075.722] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", lpFilePart=0x0) returned 0x54 [0075.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0075.722] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\dbq4qjlzxk-qhl48vym.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.722] GetFileType (hFile=0x260) returned 0x1 [0075.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0075.723] GetFileType (hFile=0x260) returned 0x1 [0075.723] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x31f7 [0075.723] ReadFile (in: hFile=0x260, lpBuffer=0x2ef3444, nNumberOfBytesToRead=0x31f7, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2ef3444*, lpNumberOfBytesRead=0xefeb50*=0x31f7, lpOverlapped=0x0) returned 1 [0075.723] CloseHandle (hObject=0x260) returned 1 [0075.738] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", lpFilePart=0x0) returned 0x54 [0075.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0075.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\dbq4qjlzxk-qhl48vym.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.739] GetFileType (hFile=0x260) returned 0x1 [0075.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0075.739] GetFileType (hFile=0x260) returned 0x1 [0075.739] WriteFile (in: hFile=0x260, lpBuffer=0x2f4fc30*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f4fc30*, lpNumberOfBytesWritten=0xefeb44*=0x3200, lpOverlapped=0x0) returned 1 [0075.740] CloseHandle (hObject=0x260) returned 1 [0075.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a", lpFilePart=0x0) returned 0x54 [0075.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a.wholocked", lpFilePart=0x0) returned 0x5e [0075.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0075.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\dbq4qjlzxk-qhl48vym.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bffe10, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xd0b59420, ftLastAccessTime.dwHighDateTime=0x1d5eee5, ftLastWriteTime.dwLowDateTime=0x4e8d2e0d, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3200)) returned 1 [0075.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0075.742] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\dbq4qjlzxk-qhl48vym.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\dbq4qjlZxk-qHl48vYm.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\dbq4qjlzxk-qhl48vym.m4a.wholocked")) returned 1 [0075.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", lpFilePart=0x0) returned 0x45 [0075.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0075.742] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\fnk2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.742] GetFileType (hFile=0x260) returned 0x1 [0075.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0075.742] GetFileType (hFile=0x260) returned 0x1 [0075.742] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0xa33d [0075.743] ReadFile (in: hFile=0x260, lpBuffer=0x2f53308, nNumberOfBytesToRead=0xa33d, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f53308*, lpNumberOfBytesRead=0xefeb50*=0xa33d, lpOverlapped=0x0) returned 1 [0075.743] CloseHandle (hObject=0x260) returned 1 [0075.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", lpFilePart=0x0) returned 0x45 [0075.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0075.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\fnk2.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.760] GetFileType (hFile=0x260) returned 0x1 [0075.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0075.760] GetFileType (hFile=0x260) returned 0x1 [0075.760] WriteFile (in: hFile=0x260, lpBuffer=0x2fd3134*, nNumberOfBytesToWrite=0xa340, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2fd3134*, lpNumberOfBytesWritten=0xefeb44*=0xa340, lpOverlapped=0x0) returned 1 [0075.810] CloseHandle (hObject=0x260) returned 1 [0075.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3", lpFilePart=0x0) returned 0x45 [0075.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3.wholocked", lpFilePart=0x0) returned 0x4f [0075.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0075.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\fnk2.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c4adf10, ftCreationTime.dwHighDateTime=0x1d5ef3d, ftLastAccessTime.dwLowDateTime=0x50eaace0, ftLastAccessTime.dwHighDateTime=0x1d5e3f4, ftLastWriteTime.dwLowDateTime=0x4e99180b, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xa340)) returned 1 [0075.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0075.813] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\fnk2.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\FNk2.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\fnk2.mp3.wholocked")) returned 1 [0075.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", lpFilePart=0x0) returned 0x4d [0075.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0075.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\v ztkmy3lgq2.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.814] GetFileType (hFile=0x260) returned 0x1 [0075.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0075.814] GetFileType (hFile=0x260) returned 0x1 [0075.814] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x2a2f [0075.814] ReadFile (in: hFile=0x260, lpBuffer=0x2fdd8d0, nNumberOfBytesToRead=0x2a2f, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fdd8d0*, lpNumberOfBytesRead=0xefeb50*=0x2a2f, lpOverlapped=0x0) returned 1 [0075.815] CloseHandle (hObject=0x260) returned 1 [0075.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", lpFilePart=0x0) returned 0x4d [0075.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0075.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\v ztkmy3lgq2.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.910] GetFileType (hFile=0x260) returned 0x1 [0075.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0075.910] GetFileType (hFile=0x260) returned 0x1 [0075.910] WriteFile (in: hFile=0x260, lpBuffer=0x2e2726c*, nNumberOfBytesToWrite=0x2a30, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e2726c*, lpNumberOfBytesWritten=0xefeb44*=0x2a30, lpOverlapped=0x0) returned 1 [0075.911] CloseHandle (hObject=0x260) returned 1 [0075.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3", lpFilePart=0x0) returned 0x4d [0075.912] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3.wholocked", lpFilePart=0x0) returned 0x57 [0075.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0075.912] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\v ztkmy3lgq2.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad5e4c0, ftCreationTime.dwHighDateTime=0x1d5e9b7, ftLastAccessTime.dwLowDateTime=0xafaf7b30, ftLastAccessTime.dwHighDateTime=0x1d5e164, ftLastWriteTime.dwLowDateTime=0x4ea7661a, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x2a30)) returned 1 [0075.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0075.913] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\v ztkmy3lgq2.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\V zTKMY3lgQ2.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\v ztkmy3lgq2.mp3.wholocked")) returned 1 [0075.913] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", lpFilePart=0x0) returned 0x4c [0075.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0075.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\vcgsvfab3pv.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.913] GetFileType (hFile=0x260) returned 0x1 [0075.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0075.914] GetFileType (hFile=0x260) returned 0x1 [0075.914] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x737f [0075.914] ReadFile (in: hFile=0x260, lpBuffer=0x2e2a144, nNumberOfBytesToRead=0x737f, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2e2a144*, lpNumberOfBytesRead=0xefeb50*=0x737f, lpOverlapped=0x0) returned 1 [0075.915] CloseHandle (hObject=0x260) returned 1 [0075.931] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", lpFilePart=0x0) returned 0x4c [0075.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0075.931] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\vcgsvfab3pv.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.932] GetFileType (hFile=0x260) returned 0x1 [0075.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0075.932] GetFileType (hFile=0x260) returned 0x1 [0075.932] WriteFile (in: hFile=0x260, lpBuffer=0x2e9b20c*, nNumberOfBytesToWrite=0x7380, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e9b20c*, lpNumberOfBytesWritten=0xefeb44*=0x7380, lpOverlapped=0x0) returned 1 [0075.933] CloseHandle (hObject=0x260) returned 1 [0075.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav", lpFilePart=0x0) returned 0x4c [0075.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav.wholocked", lpFilePart=0x0) returned 0x56 [0075.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0075.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\vcgsvfab3pv.wav"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c6d7b50, ftCreationTime.dwHighDateTime=0x1d5effe, ftLastAccessTime.dwLowDateTime=0x999c8af0, ftLastAccessTime.dwHighDateTime=0x1d5e41f, ftLastWriteTime.dwLowDateTime=0x4eac2ae9, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x7380)) returned 1 [0075.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0075.936] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\vcgsvfab3pv.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\cO59FIJkX5q\\vCgSvFAb3PV.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\co59fijkx5q\\vcgsvfab3pv.wav.wholocked")) returned 1 [0075.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0075.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0075.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.937] GetFileType (hFile=0x260) returned 0x1 [0075.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0075.937] GetFileType (hFile=0x260) returned 0x1 [0075.938] WriteFile (in: hFile=0x260, lpBuffer=0x2ea4420*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2ea4420*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0075.938] CloseHandle (hObject=0x260) returned 1 [0075.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0075.939] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.940] GetFileType (hFile=0x260) returned 0x1 [0075.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0075.940] GetFileType (hFile=0x260) returned 0x1 [0075.940] WriteFile (in: hFile=0x260, lpBuffer=0x2ea6f6c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2ea6f6c*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0075.941] CloseHandle (hObject=0x260) returned 1 [0075.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0075.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0075.941] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.942] GetFileType (hFile=0x260) returned 0x1 [0075.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0075.942] GetFileType (hFile=0x260) returned 0x1 [0075.942] WriteFile (in: hFile=0x260, lpBuffer=0x2ea9ab8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2ea9ab8*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0075.943] CloseHandle (hObject=0x260) returned 1 [0075.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0075.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0075.944] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0075.944] GetFileType (hFile=0x260) returned 0x1 [0075.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0075.944] GetFileType (hFile=0x260) returned 0x1 [0075.945] WriteFile (in: hFile=0x260, lpBuffer=0x2eac604*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2eac604*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0075.946] CloseHandle (hObject=0x260) returned 1 [0075.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0075.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw", lpFilePart=0x0) returned 0x45 [0075.946] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccc18 [0075.946] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.946] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c496b0, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7bed37d0, ftLastAccessTime.dwHighDateTime=0x1d5ebcb, ftLastWriteTime.dwLowDateTime=0x7bed37d0, ftLastWriteTime.dwHighDateTime=0x1d5ebcb, nFileSizeHigh=0x0, nFileSizeLow=0x3b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPIBtbNPUikj1fWfVGct.mp3", cAlternateFileName="GPIBTB~1.MP3")) returned 1 [0075.946] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994241e0, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x681ee8a0, ftLastAccessTime.dwHighDateTime=0x1d5eb1e, ftLastWriteTime.dwLowDateTime=0x681ee8a0, ftLastWriteTime.dwHighDateTime=0x1d5eb1e, nFileSizeHigh=0x0, nFileSizeLow=0x364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFtnttTqaR9jeev9.m4a", cAlternateFileName="YFTNTT~1.M4A")) returned 1 [0075.947] FindNextFileW (in: hFindFile=0x12ccc18, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.947] FindClose (in: hFindFile=0x12ccc18 | out: hFindFile=0x12ccc18) returned 1 [0075.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0075.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0075.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw", lpFilePart=0x0) returned 0x45 [0075.947] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccdd8 [0075.947] FindNextFileW (in: hFindFile=0x12ccdd8, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2950de0, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xb18af3c0, ftLastAccessTime.dwHighDateTime=0x1d5ed5e, ftLastWriteTime.dwLowDateTime=0xb18af3c0, ftLastWriteTime.dwHighDateTime=0x1d5ed5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.947] FindNextFileW (in: hFindFile=0x12ccdd8, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c496b0, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7bed37d0, ftLastAccessTime.dwHighDateTime=0x1d5ebcb, ftLastWriteTime.dwLowDateTime=0x7bed37d0, ftLastWriteTime.dwHighDateTime=0x1d5ebcb, nFileSizeHigh=0x0, nFileSizeLow=0x3b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPIBtbNPUikj1fWfVGct.mp3", cAlternateFileName="GPIBTB~1.MP3")) returned 1 [0075.947] FindNextFileW (in: hFindFile=0x12ccdd8, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994241e0, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x681ee8a0, ftLastAccessTime.dwHighDateTime=0x1d5eb1e, ftLastWriteTime.dwLowDateTime=0x681ee8a0, ftLastWriteTime.dwHighDateTime=0x1d5eb1e, nFileSizeHigh=0x0, nFileSizeLow=0x364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFtnttTqaR9jeev9.m4a", cAlternateFileName="YFTNTT~1.M4A")) returned 1 [0075.948] FindNextFileW (in: hFindFile=0x12ccdd8, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994241e0, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x681ee8a0, ftLastAccessTime.dwHighDateTime=0x1d5eb1e, ftLastWriteTime.dwLowDateTime=0x681ee8a0, ftLastWriteTime.dwHighDateTime=0x1d5eb1e, nFileSizeHigh=0x0, nFileSizeLow=0x364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="yFtnttTqaR9jeev9.m4a", cAlternateFileName="YFTNTT~1.M4A")) returned 0 [0075.948] FindClose (in: hFindFile=0x12ccdd8 | out: hFindFile=0x12ccdd8) returned 1 [0075.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0075.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0075.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", lpFilePart=0x0) returned 0x5e [0075.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0075.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\gpibtbnpuikj1fwfvgct.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0075.995] GetFileType (hFile=0x260) returned 0x1 [0075.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0075.995] GetFileType (hFile=0x260) returned 0x1 [0075.995] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x3b54 [0075.995] ReadFile (in: hFile=0x260, lpBuffer=0x2eaf4d0, nNumberOfBytesToRead=0x3b54, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2eaf4d0*, lpNumberOfBytesRead=0xefeb50*=0x3b54, lpOverlapped=0x0) returned 1 [0075.996] CloseHandle (hObject=0x260) returned 1 [0076.010] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", lpFilePart=0x0) returned 0x5e [0076.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0076.010] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\gpibtbnpuikj1fwfvgct.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.012] GetFileType (hFile=0x260) returned 0x1 [0076.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0076.012] GetFileType (hFile=0x260) returned 0x1 [0076.012] WriteFile (in: hFile=0x260, lpBuffer=0x2f0eb98*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f0eb98*, lpNumberOfBytesWritten=0xefeb44*=0x3b60, lpOverlapped=0x0) returned 1 [0076.013] CloseHandle (hObject=0x260) returned 1 [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3", lpFilePart=0x0) returned 0x5e [0076.014] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3.wholocked", lpFilePart=0x0) returned 0x68 [0076.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0076.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\gpibtbnpuikj1fwfvgct.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c496b0, ftCreationTime.dwHighDateTime=0x1d5ef40, ftLastAccessTime.dwLowDateTime=0x7bed37d0, ftLastAccessTime.dwHighDateTime=0x1d5ebcb, ftLastWriteTime.dwLowDateTime=0x4eb81732, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b60)) returned 1 [0076.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0076.015] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\gpibtbnpuikj1fwfvgct.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\gPIBtbNPUikj1fWfVGct.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\gpibtbnpuikj1fwfvgct.mp3.wholocked")) returned 1 [0076.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", lpFilePart=0x0) returned 0x5a [0076.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0076.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\yftntttqar9jeev9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.018] GetFileType (hFile=0x260) returned 0x1 [0076.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0076.018] GetFileType (hFile=0x260) returned 0x1 [0076.018] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x364e [0076.018] ReadFile (in: hFile=0x260, lpBuffer=0x2f12c68, nNumberOfBytesToRead=0x364e, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f12c68*, lpNumberOfBytesRead=0xefeb50*=0x364e, lpOverlapped=0x0) returned 1 [0076.018] CloseHandle (hObject=0x260) returned 1 [0076.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", lpFilePart=0x0) returned 0x5a [0076.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0076.034] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\yftntttqar9jeev9.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.034] GetFileType (hFile=0x260) returned 0x1 [0076.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0076.034] GetFileType (hFile=0x260) returned 0x1 [0076.035] WriteFile (in: hFile=0x260, lpBuffer=0x2f709e4*, nNumberOfBytesToWrite=0x3650, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f709e4*, lpNumberOfBytesWritten=0xefeb44*=0x3650, lpOverlapped=0x0) returned 1 [0076.036] CloseHandle (hObject=0x260) returned 1 [0076.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a", lpFilePart=0x0) returned 0x5a [0076.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a.wholocked", lpFilePart=0x0) returned 0x64 [0076.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0076.037] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\yftntttqar9jeev9.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994241e0, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0x681ee8a0, ftLastAccessTime.dwHighDateTime=0x1d5eb1e, ftLastWriteTime.dwLowDateTime=0x4eba7d96, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3650)) returned 1 [0076.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0076.037] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\yftntttqar9jeev9.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\FkUmlyV\\AmxhiEn_ c4SIAn5Wn\\iVcTuVovm8xJflxDCFVw\\yFtnttTqaR9jeev9.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\fkumlyv\\amxhien_ c4sian5wn\\ivctuvovm8xjflxdcfvw\\yftntttqar9jeev9.m4a.wholocked")) returned 1 [0076.037] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0076.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0076.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.038] GetFileType (hFile=0x260) returned 0x1 [0076.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0076.038] GetFileType (hFile=0x260) returned 0x1 [0076.038] WriteFile (in: hFile=0x260, lpBuffer=0x2f75f44*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f75f44*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0076.040] CloseHandle (hObject=0x260) returned 1 [0076.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0076.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.041] GetFileType (hFile=0x260) returned 0x1 [0076.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0076.041] GetFileType (hFile=0x260) returned 0x1 [0076.041] WriteFile (in: hFile=0x260, lpBuffer=0x2f78a90*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f78a90*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0076.042] CloseHandle (hObject=0x260) returned 1 [0076.074] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0076.074] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.075] GetFileType (hFile=0x260) returned 0x1 [0076.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0076.075] GetFileType (hFile=0x260) returned 0x1 [0076.075] WriteFile (in: hFile=0x260, lpBuffer=0x2f7b5dc*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f7b5dc*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0076.076] CloseHandle (hObject=0x260) returned 1 [0076.076] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0076.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0076.076] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.077] GetFileType (hFile=0x260) returned 0x1 [0076.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0076.077] GetFileType (hFile=0x260) returned 0x1 [0076.077] WriteFile (in: hFile=0x260, lpBuffer=0x2f7e128*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2f7e128*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0076.078] CloseHandle (hObject=0x260) returned 1 [0076.078] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0076.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.079] GetFileType (hFile=0x260) returned 0x1 [0076.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.079] GetFileType (hFile=0x260) returned 0x1 [0076.079] WriteFile (in: hFile=0x260, lpBuffer=0x2f80c6c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f80c6c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.080] CloseHandle (hObject=0x260) returned 1 [0076.080] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.081] GetFileType (hFile=0x260) returned 0x1 [0076.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.081] GetFileType (hFile=0x260) returned 0x1 [0076.081] WriteFile (in: hFile=0x260, lpBuffer=0x2f837b8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f837b8*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.082] CloseHandle (hObject=0x260) returned 1 [0076.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.082] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.083] GetFileType (hFile=0x260) returned 0x1 [0076.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.083] GetFileType (hFile=0x260) returned 0x1 [0076.084] WriteFile (in: hFile=0x260, lpBuffer=0x2f86304*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f86304*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.084] CloseHandle (hObject=0x260) returned 1 [0076.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0076.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.085] GetFileType (hFile=0x260) returned 0x1 [0076.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.085] GetFileType (hFile=0x260) returned 0x1 [0076.086] WriteFile (in: hFile=0x260, lpBuffer=0x2f88e50*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f88e50*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.086] CloseHandle (hObject=0x260) returned 1 [0076.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0076.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.087] GetFileType (hFile=0x260) returned 0x1 [0076.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.088] GetFileType (hFile=0x260) returned 0x1 [0076.088] WriteFile (in: hFile=0x260, lpBuffer=0x2f8b994*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f8b994*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.089] CloseHandle (hObject=0x260) returned 1 [0076.089] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.089] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.090] GetFileType (hFile=0x260) returned 0x1 [0076.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.090] GetFileType (hFile=0x260) returned 0x1 [0076.090] WriteFile (in: hFile=0x260, lpBuffer=0x2f8e4e0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f8e4e0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.091] CloseHandle (hObject=0x260) returned 1 [0076.091] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.091] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.092] GetFileType (hFile=0x260) returned 0x1 [0076.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.092] GetFileType (hFile=0x260) returned 0x1 [0076.092] WriteFile (in: hFile=0x260, lpBuffer=0x2f9102c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f9102c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.093] CloseHandle (hObject=0x260) returned 1 [0076.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0076.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.094] GetFileType (hFile=0x260) returned 0x1 [0076.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.094] GetFileType (hFile=0x260) returned 0x1 [0076.094] WriteFile (in: hFile=0x260, lpBuffer=0x2f93b78*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f93b78*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.095] CloseHandle (hObject=0x260) returned 1 [0076.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0076.095] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0", lpFilePart=0x0) returned 0x27 [0076.095] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccd58 [0076.095] FindNextFileW (in: hFindFile=0x12ccd58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.096] FindNextFileW (in: hFindFile=0x12ccd58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a335d0, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xec6bbb00, ftLastAccessTime.dwHighDateTime=0x1d5e818, ftLastWriteTime.dwLowDateTime=0xec6bbb00, ftLastWriteTime.dwHighDateTime=0x1d5e818, nFileSizeHigh=0x0, nFileSizeLow=0x16a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="k34cI 4MoueZlam0cN.mp3", cAlternateFileName="K34CI4~1.MP3")) returned 1 [0076.096] FindNextFileW (in: hFindFile=0x12ccd58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tRVNK3kRut", cAlternateFileName="TRVNK3~1")) returned 1 [0076.096] FindNextFileW (in: hFindFile=0x12ccd58, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tRVNK3kRut", cAlternateFileName="TRVNK3~1")) returned 0 [0076.096] FindClose (in: hFindFile=0x12ccd58 | out: hFindFile=0x12ccd58) returned 1 [0076.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0076.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0076.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0076.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0", lpFilePart=0x0) returned 0x27 [0076.096] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cce18 [0076.096] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf158280, ftCreationTime.dwHighDateTime=0x1d5f09c, ftLastAccessTime.dwLowDateTime=0x62294a30, ftLastAccessTime.dwHighDateTime=0x1d5e646, ftLastWriteTime.dwLowDateTime=0x62294a30, ftLastWriteTime.dwHighDateTime=0x1d5e646, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.097] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a335d0, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xec6bbb00, ftLastAccessTime.dwHighDateTime=0x1d5e818, ftLastWriteTime.dwLowDateTime=0xec6bbb00, ftLastWriteTime.dwHighDateTime=0x1d5e818, nFileSizeHigh=0x0, nFileSizeLow=0x16a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="k34cI 4MoueZlam0cN.mp3", cAlternateFileName="K34CI4~1.MP3")) returned 1 [0076.097] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tRVNK3kRut", cAlternateFileName="TRVNK3~1")) returned 1 [0076.097] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.097] FindClose (in: hFindFile=0x12cce18 | out: hFindFile=0x12cce18) returned 1 [0076.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0076.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0076.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", lpFilePart=0x0) returned 0x3e [0076.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0076.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\k34ci 4mouezlam0cn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.097] GetFileType (hFile=0x260) returned 0x1 [0076.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0076.097] GetFileType (hFile=0x260) returned 0x1 [0076.097] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x16a91 [0076.098] ReadFile (in: hFile=0x260, lpBuffer=0x3fc96c8, nNumberOfBytesToRead=0x16a91, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x3fc96c8*, lpNumberOfBytesRead=0xefec60*=0x16a91, lpOverlapped=0x0) returned 1 [0076.100] CloseHandle (hObject=0x260) returned 1 [0076.169] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", lpFilePart=0x0) returned 0x3e [0076.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0076.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\k34ci 4mouezlam0cn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.170] GetFileType (hFile=0x260) returned 0x1 [0076.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0076.170] GetFileType (hFile=0x260) returned 0x1 [0076.170] WriteFile (in: hFile=0x260, lpBuffer=0x403ac18*, nNumberOfBytesToWrite=0x16aa0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x403ac18*, lpNumberOfBytesWritten=0xefec54*=0x16aa0, lpOverlapped=0x0) returned 1 [0076.173] CloseHandle (hObject=0x260) returned 1 [0076.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3", lpFilePart=0x0) returned 0x3e [0076.175] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3.wholocked", lpFilePart=0x0) returned 0x48 [0076.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0076.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\k34ci 4mouezlam0cn.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a335d0, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xec6bbb00, ftLastAccessTime.dwHighDateTime=0x1d5e818, ftLastWriteTime.dwLowDateTime=0x4ecfefb5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x16aa0)) returned 1 [0076.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0076.175] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\k34ci 4mouezlam0cn.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\k34cI 4MoueZlam0cN.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\k34ci 4mouezlam0cn.mp3.wholocked")) returned 1 [0076.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0076.176] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut", lpFilePart=0x0) returned 0x32 [0076.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccf58 [0076.176] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.176] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1428dd20, ftCreationTime.dwHighDateTime=0x1d5f02b, ftLastAccessTime.dwLowDateTime=0x32998a60, ftLastAccessTime.dwHighDateTime=0x1d5f054, ftLastWriteTime.dwLowDateTime=0x32998a60, ftLastWriteTime.dwHighDateTime=0x1d5f054, nFileSizeHigh=0x0, nFileSizeLow=0xd30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 5FbHPf6R2mdAzaO.m4a", cAlternateFileName="15FBHP~1.M4A")) returned 1 [0076.176] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73373ca0, ftCreationTime.dwHighDateTime=0x1d5eca0, ftLastAccessTime.dwLowDateTime=0x9aa4eee0, ftLastAccessTime.dwHighDateTime=0x1d5eba1, ftLastWriteTime.dwLowDateTime=0x9aa4eee0, ftLastWriteTime.dwHighDateTime=0x1d5eba1, nFileSizeHigh=0x0, nFileSizeLow=0x109e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1wGm9XiZzO_C.m4a", cAlternateFileName="1WGM9X~1.M4A")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc61bf20, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0x104acc50, ftLastAccessTime.dwHighDateTime=0x1d5e148, ftLastWriteTime.dwLowDateTime=0x104acc50, ftLastWriteTime.dwHighDateTime=0x1d5e148, nFileSizeHigh=0x0, nFileSizeLow=0x1547a, dwReserved0=0x0, dwReserved1=0x0, cFileName="23 k8fXa.mp3", cAlternateFileName="23K8FX~1.MP3")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d1e0, ftCreationTime.dwHighDateTime=0x1d5e272, ftLastAccessTime.dwLowDateTime=0x67b84400, ftLastAccessTime.dwHighDateTime=0x1d5e53e, ftLastWriteTime.dwLowDateTime=0x67b84400, ftLastWriteTime.dwHighDateTime=0x1d5e53e, nFileSizeHigh=0x0, nFileSizeLow=0x9897, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NFxQozpb9FHnGP8wI.mp3", cAlternateFileName="8NFXQO~1.MP3")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf637a970, ftCreationTime.dwHighDateTime=0x1d5ef9b, ftLastAccessTime.dwLowDateTime=0xa4800080, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0xa4800080, ftLastWriteTime.dwHighDateTime=0x1d5eb79, nFileSizeHigh=0x0, nFileSizeLow=0x135ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="efToj2KDZTPE5g4MRAea.wav", cAlternateFileName="EFTOJ2~1.WAV")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa062eb0, ftCreationTime.dwHighDateTime=0x1d5e347, ftLastAccessTime.dwLowDateTime=0xc7290b80, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0xc7290b80, ftLastWriteTime.dwHighDateTime=0x1d5e819, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qvha3vPmcNUYmoQLC0mm.m4a", cAlternateFileName="QVHA3V~1.M4A")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b412410, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x9fe49c50, ftLastAccessTime.dwHighDateTime=0x1d5e3ab, ftLastWriteTime.dwLowDateTime=0x9fe49c50, ftLastWriteTime.dwHighDateTime=0x1d5e3ab, nFileSizeHigh=0x0, nFileSizeLow=0x18526, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZ-RiW17WZwzNm_7gGw.wav", cAlternateFileName="VZ-RIW~1.WAV")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x12ccf58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.177] FindClose (in: hFindFile=0x12ccf58 | out: hFindFile=0x12ccf58) returned 1 [0076.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0076.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0076.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0076.177] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut", lpFilePart=0x0) returned 0x32 [0076.177] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccbd8 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13c4060, ftCreationTime.dwHighDateTime=0x1d5f11b, ftLastAccessTime.dwLowDateTime=0xf469d2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9c6, ftLastWriteTime.dwLowDateTime=0xf469d2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9c6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1428dd20, ftCreationTime.dwHighDateTime=0x1d5f02b, ftLastAccessTime.dwLowDateTime=0x32998a60, ftLastAccessTime.dwHighDateTime=0x1d5f054, ftLastWriteTime.dwLowDateTime=0x32998a60, ftLastWriteTime.dwHighDateTime=0x1d5f054, nFileSizeHigh=0x0, nFileSizeLow=0xd30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 5FbHPf6R2mdAzaO.m4a", cAlternateFileName="15FBHP~1.M4A")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73373ca0, ftCreationTime.dwHighDateTime=0x1d5eca0, ftLastAccessTime.dwLowDateTime=0x9aa4eee0, ftLastAccessTime.dwHighDateTime=0x1d5eba1, ftLastWriteTime.dwLowDateTime=0x9aa4eee0, ftLastWriteTime.dwHighDateTime=0x1d5eba1, nFileSizeHigh=0x0, nFileSizeLow=0x109e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="1wGm9XiZzO_C.m4a", cAlternateFileName="1WGM9X~1.M4A")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc61bf20, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0x104acc50, ftLastAccessTime.dwHighDateTime=0x1d5e148, ftLastWriteTime.dwLowDateTime=0x104acc50, ftLastWriteTime.dwHighDateTime=0x1d5e148, nFileSizeHigh=0x0, nFileSizeLow=0x1547a, dwReserved0=0x0, dwReserved1=0x0, cFileName="23 k8fXa.mp3", cAlternateFileName="23K8FX~1.MP3")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d1e0, ftCreationTime.dwHighDateTime=0x1d5e272, ftLastAccessTime.dwLowDateTime=0x67b84400, ftLastAccessTime.dwHighDateTime=0x1d5e53e, ftLastWriteTime.dwLowDateTime=0x67b84400, ftLastWriteTime.dwHighDateTime=0x1d5e53e, nFileSizeHigh=0x0, nFileSizeLow=0x9897, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NFxQozpb9FHnGP8wI.mp3", cAlternateFileName="8NFXQO~1.MP3")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf637a970, ftCreationTime.dwHighDateTime=0x1d5ef9b, ftLastAccessTime.dwLowDateTime=0xa4800080, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0xa4800080, ftLastWriteTime.dwHighDateTime=0x1d5eb79, nFileSizeHigh=0x0, nFileSizeLow=0x135ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="efToj2KDZTPE5g4MRAea.wav", cAlternateFileName="EFTOJ2~1.WAV")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa062eb0, ftCreationTime.dwHighDateTime=0x1d5e347, ftLastAccessTime.dwLowDateTime=0xc7290b80, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0xc7290b80, ftLastWriteTime.dwHighDateTime=0x1d5e819, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qvha3vPmcNUYmoQLC0mm.m4a", cAlternateFileName="QVHA3V~1.M4A")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b412410, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x9fe49c50, ftLastAccessTime.dwHighDateTime=0x1d5e3ab, ftLastWriteTime.dwLowDateTime=0x9fe49c50, ftLastWriteTime.dwHighDateTime=0x1d5e3ab, nFileSizeHigh=0x0, nFileSizeLow=0x18526, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZ-RiW17WZwzNm_7gGw.wav", cAlternateFileName="VZ-RIW~1.WAV")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x12ccbd8, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b412410, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x9fe49c50, ftLastAccessTime.dwHighDateTime=0x1d5e3ab, ftLastWriteTime.dwLowDateTime=0x9fe49c50, ftLastWriteTime.dwHighDateTime=0x1d5e3ab, nFileSizeHigh=0x0, nFileSizeLow=0x18526, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZ-RiW17WZwzNm_7gGw.wav", cAlternateFileName="VZ-RIW~1.WAV")) returned 0 [0076.179] FindClose (in: hFindFile=0x12ccbd8 | out: hFindFile=0x12ccbd8) returned 1 [0076.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0076.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0076.179] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", lpFilePart=0x0) returned 0x48 [0076.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.179] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1 5fbhpf6r2mdazao.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.179] GetFileType (hFile=0x260) returned 0x1 [0076.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.179] GetFileType (hFile=0x260) returned 0x1 [0076.180] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xd30f [0076.180] ReadFile (in: hFile=0x260, lpBuffer=0x2fe5f8c, nNumberOfBytesToRead=0xd30f, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2fe5f8c*, lpNumberOfBytesRead=0xefebd8*=0xd30f, lpOverlapped=0x0) returned 1 [0076.180] CloseHandle (hObject=0x260) returned 1 [0076.459] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", lpFilePart=0x0) returned 0x48 [0076.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.459] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1 5fbhpf6r2mdazao.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.461] GetFileType (hFile=0x260) returned 0x1 [0076.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.461] GetFileType (hFile=0x260) returned 0x1 [0076.461] WriteFile (in: hFile=0x260, lpBuffer=0x2e64b5c*, nNumberOfBytesToWrite=0xd310, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e64b5c*, lpNumberOfBytesWritten=0xefebcc*=0xd310, lpOverlapped=0x0) returned 1 [0076.463] CloseHandle (hObject=0x260) returned 1 [0076.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a", lpFilePart=0x0) returned 0x48 [0076.465] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a.wholocked", lpFilePart=0x0) returned 0x52 [0076.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1 5fbhpf6r2mdazao.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1428dd20, ftCreationTime.dwHighDateTime=0x1d5f02b, ftLastAccessTime.dwLowDateTime=0x32998a60, ftLastAccessTime.dwHighDateTime=0x1d5f054, ftLastWriteTime.dwLowDateTime=0x4efd3c5c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xd310)) returned 1 [0076.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.465] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1 5fbhpf6r2mdazao.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1 5FbHPf6R2mdAzaO.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1 5fbhpf6r2mdazao.m4a.wholocked")) returned 1 [0076.466] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", lpFilePart=0x0) returned 0x43 [0076.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1wgm9xizzo_c.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.467] GetFileType (hFile=0x260) returned 0x1 [0076.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.467] GetFileType (hFile=0x260) returned 0x1 [0076.467] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x109e6 [0076.467] ReadFile (in: hFile=0x260, lpBuffer=0x2e722ec, nNumberOfBytesToRead=0x109e6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e722ec*, lpNumberOfBytesRead=0xefebd8*=0x109e6, lpOverlapped=0x0) returned 1 [0076.467] CloseHandle (hObject=0x260) returned 1 [0076.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", lpFilePart=0x0) returned 0x43 [0076.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.548] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1wgm9xizzo_c.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.549] GetFileType (hFile=0x260) returned 0x1 [0076.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.549] GetFileType (hFile=0x260) returned 0x1 [0076.550] WriteFile (in: hFile=0x260, lpBuffer=0x2ef1018*, nNumberOfBytesToWrite=0x109f0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ef1018*, lpNumberOfBytesWritten=0xefebcc*=0x109f0, lpOverlapped=0x0) returned 1 [0076.551] CloseHandle (hObject=0x260) returned 1 [0076.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a", lpFilePart=0x0) returned 0x43 [0076.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a.wholocked", lpFilePart=0x0) returned 0x4d [0076.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1wgm9xizzo_c.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73373ca0, ftCreationTime.dwHighDateTime=0x1d5eca0, ftLastAccessTime.dwLowDateTime=0x9aa4eee0, ftLastAccessTime.dwHighDateTime=0x1d5eba1, ftLastWriteTime.dwLowDateTime=0x4f0927fa, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x109f0)) returned 1 [0076.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.554] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1wgm9xizzo_c.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\1wGm9XiZzO_C.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\1wgm9xizzo_c.m4a.wholocked")) returned 1 [0076.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", lpFilePart=0x0) returned 0x3f [0076.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.555] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\23 k8fxa.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.555] GetFileType (hFile=0x260) returned 0x1 [0076.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.555] GetFileType (hFile=0x260) returned 0x1 [0076.555] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x1547a [0076.555] ReadFile (in: hFile=0x260, lpBuffer=0x408d0d8, nNumberOfBytesToRead=0x1547a, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x408d0d8*, lpNumberOfBytesRead=0xefebd8*=0x1547a, lpOverlapped=0x0) returned 1 [0076.557] CloseHandle (hObject=0x260) returned 1 [0076.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", lpFilePart=0x0) returned 0x3f [0076.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.622] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\23 k8fxa.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.623] GetFileType (hFile=0x260) returned 0x1 [0076.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.624] GetFileType (hFile=0x260) returned 0x1 [0076.624] WriteFile (in: hFile=0x260, lpBuffer=0x3df1bf8*, nNumberOfBytesToWrite=0x15480, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3df1bf8*, lpNumberOfBytesWritten=0xefebcc*=0x15480, lpOverlapped=0x0) returned 1 [0076.626] CloseHandle (hObject=0x260) returned 1 [0076.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3", lpFilePart=0x0) returned 0x3f [0076.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3.wholocked", lpFilePart=0x0) returned 0x49 [0076.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\23 k8fxa.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc61bf20, ftCreationTime.dwHighDateTime=0x1d5effd, ftLastAccessTime.dwLowDateTime=0x104acc50, ftLastAccessTime.dwHighDateTime=0x1d5e148, ftLastWriteTime.dwLowDateTime=0x4f151412, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x15480)) returned 1 [0076.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.628] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\23 k8fxa.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\23 k8fXa.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\23 k8fxa.mp3.wholocked")) returned 1 [0076.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", lpFilePart=0x0) returned 0x49 [0076.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\8nfxqozpb9fhngp8wi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.629] GetFileType (hFile=0x260) returned 0x1 [0076.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.629] GetFileType (hFile=0x260) returned 0x1 [0076.629] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x9897 [0076.629] ReadFile (in: hFile=0x260, lpBuffer=0x2dcee3c, nNumberOfBytesToRead=0x9897, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2dcee3c*, lpNumberOfBytesRead=0xefebd8*=0x9897, lpOverlapped=0x0) returned 1 [0076.630] CloseHandle (hObject=0x260) returned 1 [0076.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", lpFilePart=0x0) returned 0x49 [0076.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\8nfxqozpb9fhngp8wi.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.726] GetFileType (hFile=0x260) returned 0x1 [0076.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.726] GetFileType (hFile=0x260) returned 0x1 [0076.726] WriteFile (in: hFile=0x260, lpBuffer=0x2e4b908*, nNumberOfBytesToWrite=0x98a0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e4b908*, lpNumberOfBytesWritten=0xefebcc*=0x98a0, lpOverlapped=0x0) returned 1 [0076.728] CloseHandle (hObject=0x260) returned 1 [0076.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3", lpFilePart=0x0) returned 0x49 [0076.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3.wholocked", lpFilePart=0x0) returned 0x53 [0076.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\8nfxqozpb9fhngp8wi.mp3"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53d1e0, ftCreationTime.dwHighDateTime=0x1d5e272, ftLastAccessTime.dwLowDateTime=0x67b84400, ftLastAccessTime.dwHighDateTime=0x1d5e53e, ftLastWriteTime.dwLowDateTime=0x4f236222, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x98a0)) returned 1 [0076.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\8nfxqozpb9fhngp8wi.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\8NFxQozpb9FHnGP8wI.mp3.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\8nfxqozpb9fhngp8wi.mp3.wholocked")) returned 1 [0076.730] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", lpFilePart=0x0) returned 0x4b [0076.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.730] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\eftoj2kdztpe5g4mraea.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.731] GetFileType (hFile=0x260) returned 0x1 [0076.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.731] GetFileType (hFile=0x260) returned 0x1 [0076.731] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x135ee [0076.731] ReadFile (in: hFile=0x260, lpBuffer=0x2e5564c, nNumberOfBytesToRead=0x135ee, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e5564c*, lpNumberOfBytesRead=0xefebd8*=0x135ee, lpOverlapped=0x0) returned 1 [0076.731] CloseHandle (hObject=0x260) returned 1 [0076.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", lpFilePart=0x0) returned 0x4b [0076.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\eftoj2kdztpe5g4mraea.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.749] GetFileType (hFile=0x260) returned 0x1 [0076.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.749] GetFileType (hFile=0x260) returned 0x1 [0076.750] WriteFile (in: hFile=0x260, lpBuffer=0x2edc61c*, nNumberOfBytesToWrite=0x135f0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2edc61c*, lpNumberOfBytesWritten=0xefebcc*=0x135f0, lpOverlapped=0x0) returned 1 [0076.751] CloseHandle (hObject=0x260) returned 1 [0076.754] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav", lpFilePart=0x0) returned 0x4b [0076.754] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav.wholocked", lpFilePart=0x0) returned 0x55 [0076.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.754] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\eftoj2kdztpe5g4mraea.wav"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf637a970, ftCreationTime.dwHighDateTime=0x1d5ef9b, ftLastAccessTime.dwLowDateTime=0xa4800080, ftLastAccessTime.dwHighDateTime=0x1d5eb79, ftLastWriteTime.dwLowDateTime=0x4f282681, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x135f0)) returned 1 [0076.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.754] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\eftoj2kdztpe5g4mraea.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\efToj2KDZTPE5g4MRAea.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\eftoj2kdztpe5g4mraea.wav.wholocked")) returned 1 [0076.754] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", lpFilePart=0x0) returned 0x4b [0076.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.754] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\qvha3vpmcnuymoqlc0mm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.755] GetFileType (hFile=0x260) returned 0x1 [0076.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.755] GetFileType (hFile=0x260) returned 0x1 [0076.755] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x227a [0076.755] ReadFile (in: hFile=0x260, lpBuffer=0x2ef00c4, nNumberOfBytesToRead=0x227a, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2ef00c4*, lpNumberOfBytesRead=0xefebd8*=0x227a, lpOverlapped=0x0) returned 1 [0076.755] CloseHandle (hObject=0x260) returned 1 [0076.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", lpFilePart=0x0) returned 0x4b [0076.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\qvha3vpmcnuymoqlc0mm.m4a"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.818] GetFileType (hFile=0x260) returned 0x1 [0076.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.818] GetFileType (hFile=0x260) returned 0x1 [0076.818] WriteFile (in: hFile=0x260, lpBuffer=0x2f47b30*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f47b30*, lpNumberOfBytesWritten=0xefebcc*=0x2280, lpOverlapped=0x0) returned 1 [0076.819] CloseHandle (hObject=0x260) returned 1 [0076.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a", lpFilePart=0x0) returned 0x4b [0076.820] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a.wholocked", lpFilePart=0x0) returned 0x55 [0076.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\qvha3vpmcnuymoqlc0mm.m4a"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa062eb0, ftCreationTime.dwHighDateTime=0x1d5e347, ftLastAccessTime.dwLowDateTime=0xc7290b80, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x4f31affa, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x2280)) returned 1 [0076.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.820] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\qvha3vpmcnuymoqlc0mm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\Qvha3vPmcNUYmoQLC0mm.m4a.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\qvha3vpmcnuymoqlc0mm.m4a.wholocked")) returned 1 [0076.821] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", lpFilePart=0x0) returned 0x4a [0076.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0076.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\vz-riw17wzwznm_7ggw.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.821] GetFileType (hFile=0x260) returned 0x1 [0076.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0076.821] GetFileType (hFile=0x260) returned 0x1 [0076.821] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x18526 [0076.821] ReadFile (in: hFile=0x260, lpBuffer=0x3e2dc78, nNumberOfBytesToRead=0x18526, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x3e2dc78*, lpNumberOfBytesRead=0xefebd8*=0x18526, lpOverlapped=0x0) returned 1 [0076.822] CloseHandle (hObject=0x260) returned 1 [0076.841] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", lpFilePart=0x0) returned 0x4a [0076.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0076.841] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\vz-riw17wzwznm_7ggw.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.842] GetFileType (hFile=0x260) returned 0x1 [0076.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0076.843] GetFileType (hFile=0x260) returned 0x1 [0076.843] WriteFile (in: hFile=0x260, lpBuffer=0x3ea76a0*, nNumberOfBytesToWrite=0x18530, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x3ea76a0*, lpNumberOfBytesWritten=0xefebcc*=0x18530, lpOverlapped=0x0) returned 1 [0076.845] CloseHandle (hObject=0x260) returned 1 [0076.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav", lpFilePart=0x0) returned 0x4a [0076.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav.wholocked", lpFilePart=0x0) returned 0x54 [0076.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0076.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\vz-riw17wzwznm_7ggw.wav"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b412410, ftCreationTime.dwHighDateTime=0x1d5e22d, ftLastAccessTime.dwLowDateTime=0x9fe49c50, ftLastAccessTime.dwHighDateTime=0x1d5e3ab, ftLastWriteTime.dwLowDateTime=0x4f367448, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x18530)) returned 1 [0076.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0076.847] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\vz-riw17wzwznm_7ggw.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\JLQO-OboxE_dRiRf0\\tRVNK3kRut\\VZ-RiW17WZwzNm_7gGw.wav.wholocked" (normalized: "c:\\users\\fd1hvy\\music\\jlqo-oboxe_drirf0\\trvnk3krut\\vz-riw17wzwznm_7ggw.wav.wholocked")) returned 1 [0076.848] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0076.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.849] GetFileType (hFile=0x260) returned 0x1 [0076.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.849] GetFileType (hFile=0x260) returned 0x1 [0076.849] WriteFile (in: hFile=0x260, lpBuffer=0x2f98ef0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f98ef0*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.850] CloseHandle (hObject=0x260) returned 1 [0076.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.850] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.851] GetFileType (hFile=0x260) returned 0x1 [0076.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.851] GetFileType (hFile=0x260) returned 0x1 [0076.851] WriteFile (in: hFile=0x260, lpBuffer=0x2f9ba3c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f9ba3c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.852] CloseHandle (hObject=0x260) returned 1 [0076.852] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.853] GetFileType (hFile=0x260) returned 0x1 [0076.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.853] GetFileType (hFile=0x260) returned 0x1 [0076.854] WriteFile (in: hFile=0x260, lpBuffer=0x2f9e588*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f9e588*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.902] CloseHandle (hObject=0x260) returned 1 [0076.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0076.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0076.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.904] GetFileType (hFile=0x260) returned 0x1 [0076.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0076.904] GetFileType (hFile=0x260) returned 0x1 [0076.904] WriteFile (in: hFile=0x260, lpBuffer=0x2fa10d4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2fa10d4*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0076.905] CloseHandle (hObject=0x260) returned 1 [0076.905] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0076.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.905] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.906] GetFileType (hFile=0x260) returned 0x1 [0076.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.906] GetFileType (hFile=0x260) returned 0x1 [0076.906] WriteFile (in: hFile=0x260, lpBuffer=0x2fa3c18*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fa3c18*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.907] CloseHandle (hObject=0x260) returned 1 [0076.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.908] GetFileType (hFile=0x260) returned 0x1 [0076.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.908] GetFileType (hFile=0x260) returned 0x1 [0076.908] WriteFile (in: hFile=0x260, lpBuffer=0x2fa6764*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fa6764*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.909] CloseHandle (hObject=0x260) returned 1 [0076.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0076.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.913] GetFileType (hFile=0x260) returned 0x1 [0076.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.913] GetFileType (hFile=0x260) returned 0x1 [0076.913] WriteFile (in: hFile=0x260, lpBuffer=0x2fa92b0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fa92b0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.914] CloseHandle (hObject=0x260) returned 1 [0076.914] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0076.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0076.914] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0076.915] GetFileType (hFile=0x260) returned 0x1 [0076.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0076.915] GetFileType (hFile=0x260) returned 0x1 [0076.915] WriteFile (in: hFile=0x260, lpBuffer=0x2fabdfc*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fabdfc*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0076.916] CloseHandle (hObject=0x260) returned 1 [0076.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0076.916] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\", lpFilePart=0x0) returned 0x17 [0076.916] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe558f56c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe558f56c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccc98 [0076.916] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe558f56c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe558f56c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.917] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.917] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h-OvM", cAlternateFileName="")) returned 1 [0076.917] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd24a790, ftCreationTime.dwHighDateTime=0x1d5eca8, ftLastAccessTime.dwLowDateTime=0xebf95ac0, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0xebf95ac0, ftLastWriteTime.dwHighDateTime=0x1d5e713, nFileSizeHigh=0x0, nFileSizeLow=0x12f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDciC.flv", cAlternateFileName="")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265c9ee0, ftCreationTime.dwHighDateTime=0x1d5e221, ftLastAccessTime.dwLowDateTime=0x7d8a68d0, ftLastAccessTime.dwHighDateTime=0x1d5ea25, ftLastWriteTime.dwLowDateTime=0x7d8a68d0, ftLastWriteTime.dwHighDateTime=0x1d5ea25, nFileSizeHigh=0x0, nFileSizeLow=0x17497, dwReserved0=0x0, dwReserved1=0x0, cFileName="RxQRBO2fsVIlFxJH5fJ.swf", cAlternateFileName="RXQRBO~1.SWF")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa397f50, ftCreationTime.dwHighDateTime=0x1d5ec3d, ftLastAccessTime.dwLowDateTime=0xd8f83d00, ftLastAccessTime.dwHighDateTime=0x1d5e4ad, ftLastWriteTime.dwLowDateTime=0xd8f83d00, ftLastWriteTime.dwHighDateTime=0x1d5e4ad, nFileSizeHigh=0x0, nFileSizeLow=0xde18, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVbSxl8.flv", cAlternateFileName="")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WW7MXwKGyuA", cAlternateFileName="WW7MXW~1")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YSm0XsNkhPth5e1iK", cAlternateFileName="YSM0XS~1")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x12ccc98, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YSm0XsNkhPth5e1iK", cAlternateFileName="YSM0XS~1")) returned 0 [0076.918] FindClose (in: hFindFile=0x12ccc98 | out: hFindFile=0x12ccc98) returned 1 [0076.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0076.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0076.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed90) returned 1 [0076.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\", nBufferLength=0x105, lpBuffer=0xefe844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\", lpFilePart=0x0) returned 0x17 [0076.919] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0xefeab8 | out: lpFindFileData=0xefeab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe558f56c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe558f56c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccfd8 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe558f56c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe558f56c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="h-OvM", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd24a790, ftCreationTime.dwHighDateTime=0x1d5eca8, ftLastAccessTime.dwLowDateTime=0xebf95ac0, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0xebf95ac0, ftLastWriteTime.dwHighDateTime=0x1d5e713, nFileSizeHigh=0x0, nFileSizeLow=0x12f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDciC.flv", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x265c9ee0, ftCreationTime.dwHighDateTime=0x1d5e221, ftLastAccessTime.dwLowDateTime=0x7d8a68d0, ftLastAccessTime.dwHighDateTime=0x1d5ea25, ftLastWriteTime.dwLowDateTime=0x7d8a68d0, ftLastWriteTime.dwHighDateTime=0x1d5ea25, nFileSizeHigh=0x0, nFileSizeLow=0x17497, dwReserved0=0x0, dwReserved1=0x0, cFileName="RxQRBO2fsVIlFxJH5fJ.swf", cAlternateFileName="RXQRBO~1.SWF")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa397f50, ftCreationTime.dwHighDateTime=0x1d5ec3d, ftLastAccessTime.dwLowDateTime=0xd8f83d00, ftLastAccessTime.dwHighDateTime=0x1d5e4ad, ftLastWriteTime.dwLowDateTime=0xd8f83d00, ftLastWriteTime.dwHighDateTime=0x1d5e4ad, nFileSizeHigh=0x0, nFileSizeLow=0xde18, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVbSxl8.flv", cAlternateFileName="")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WW7MXwKGyuA", cAlternateFileName="WW7MXW~1")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YSm0XsNkhPth5e1iK", cAlternateFileName="YSM0XS~1")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x12ccfd8, lpFindFileData=0xefeac4 | out: lpFindFileData=0xefeac4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.920] FindClose (in: hFindFile=0x12ccfd8 | out: hFindFile=0x12ccfd8) returned 1 [0076.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed4c) returned 1 [0076.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed58) returned 1 [0076.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", lpFilePart=0x0) returned 0x20 [0076.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0076.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pdcic.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0076.920] GetFileType (hFile=0x260) returned 0x1 [0076.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0076.920] GetFileType (hFile=0x260) returned 0x1 [0076.920] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0x12f52 [0076.921] ReadFile (in: hFile=0x260, lpBuffer=0x2faeb00, nNumberOfBytesToRead=0x12f52, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2faeb00*, lpNumberOfBytesRead=0xefece8*=0x12f52, lpOverlapped=0x0) returned 1 [0076.921] CloseHandle (hObject=0x260) returned 1 [0077.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", lpFilePart=0x0) returned 0x20 [0077.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0077.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pdcic.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.019] GetFileType (hFile=0x260) returned 0x1 [0077.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0077.019] GetFileType (hFile=0x260) returned 0x1 [0077.019] WriteFile (in: hFile=0x260, lpBuffer=0x2e482f8*, nNumberOfBytesToWrite=0x12f60, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2e482f8*, lpNumberOfBytesWritten=0xefecdc*=0x12f60, lpOverlapped=0x0) returned 1 [0077.021] CloseHandle (hObject=0x260) returned 1 [0077.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PDciC.flv", lpFilePart=0x0) returned 0x20 [0077.023] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\PDciC.flv.wholocked", lpFilePart=0x0) returned 0x2a [0077.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0077.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pdcic.flv"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd24a790, ftCreationTime.dwHighDateTime=0x1d5eca8, ftLastAccessTime.dwLowDateTime=0xebf95ac0, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x4f50b272, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x12f60)) returned 1 [0077.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0077.023] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pdcic.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PDciC.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\pdcic.flv.wholocked")) returned 1 [0077.024] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", lpFilePart=0x0) returned 0x22 [0077.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec40) returned 1 [0077.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vvbsxl8.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.024] GetFileType (hFile=0x260) returned 0x1 [0077.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0077.024] GetFileType (hFile=0x260) returned 0x1 [0077.024] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefed3c | out: lpFileSizeHigh=0xefed3c*=0x0) returned 0xde18 [0077.024] ReadFile (in: hFile=0x260, lpBuffer=0x2e5b54c, nNumberOfBytesToRead=0xde18, lpNumberOfBytesRead=0xefece8, lpOverlapped=0x0 | out: lpBuffer=0x2e5b54c*, lpNumberOfBytesRead=0xefece8*=0xde18, lpOverlapped=0x0) returned 1 [0077.025] CloseHandle (hObject=0x260) returned 1 [0077.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", nBufferLength=0x105, lpBuffer=0xefe6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", lpFilePart=0x0) returned 0x22 [0077.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec2c) returned 1 [0077.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vvbsxl8.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.092] GetFileType (hFile=0x260) returned 0x1 [0077.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec28) returned 1 [0077.092] GetFileType (hFile=0x260) returned 0x1 [0077.092] WriteFile (in: hFile=0x260, lpBuffer=0x2ed1f04*, nNumberOfBytesToWrite=0xde20, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2ed1f04*, lpNumberOfBytesWritten=0xefecdc*=0xde20, lpOverlapped=0x0) returned 1 [0077.094] CloseHandle (hObject=0x260) returned 1 [0077.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv", lpFilePart=0x0) returned 0x22 [0077.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv.wholocked", lpFilePart=0x0) returned 0x2c [0077.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefecc0) returned 1 [0077.096] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vvbsxl8.flv"), fInfoLevelId=0x0, lpFileInformation=0xefed3c | out: lpFileInformation=0xefed3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa397f50, ftCreationTime.dwHighDateTime=0x1d5ec3d, ftLastAccessTime.dwLowDateTime=0xd8f83d00, ftLastAccessTime.dwHighDateTime=0x1d5e4ad, ftLastWriteTime.dwLowDateTime=0x4f5c99f7, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xde20)) returned 1 [0077.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecbc) returned 1 [0077.096] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\vvbsxl8.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\VVbSxl8.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\vvbsxl8.flv.wholocked")) returned 1 [0077.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0077.096] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM", lpFilePart=0x0) returned 0x1c [0077.096] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd258 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x790dffd0, ftCreationTime.dwHighDateTime=0x1d5e5f0, ftLastAccessTime.dwLowDateTime=0x6297ca70, ftLastAccessTime.dwHighDateTime=0x1d5e117, ftLastWriteTime.dwLowDateTime=0x6297ca70, ftLastWriteTime.dwHighDateTime=0x1d5e117, nFileSizeHigh=0x0, nFileSizeLow=0x56f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7mSuKTeWXR6I5eT.swf", cAlternateFileName="7MSUKT~1.SWF")) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cec47a0, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x8b753400, ftLastAccessTime.dwHighDateTime=0x1d5eb76, ftLastWriteTime.dwLowDateTime=0x8b753400, ftLastWriteTime.dwHighDateTime=0x1d5eb76, nFileSizeHigh=0x0, nFileSizeLow=0x7973, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr6C9Askw3d qhMXNoO.swf", cAlternateFileName="SR6C9A~1.SWF")) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VAiXlftvNFz8IyND55", cAlternateFileName="VAIXLF~1")) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3e9710, ftCreationTime.dwHighDateTime=0x1d5e254, ftLastAccessTime.dwLowDateTime=0x610a0c40, ftLastAccessTime.dwHighDateTime=0x1d5e38d, ftLastWriteTime.dwLowDateTime=0x610a0c40, ftLastWriteTime.dwHighDateTime=0x1d5e38d, nFileSizeHigh=0x0, nFileSizeLow=0x1156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WW0nBKhKm.swf", cAlternateFileName="WW0NBK~1.SWF")) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x12cd258, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.098] FindClose (in: hFindFile=0x12cd258 | out: hFindFile=0x12cd258) returned 1 [0077.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0077.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0077.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0077.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM", lpFilePart=0x0) returned 0x1c [0077.098] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccf18 [0077.098] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa61e8940, ftCreationTime.dwHighDateTime=0x1d5ecc1, ftLastAccessTime.dwLowDateTime=0x18670420, ftLastAccessTime.dwHighDateTime=0x1d5e6f8, ftLastWriteTime.dwLowDateTime=0x18670420, ftLastWriteTime.dwHighDateTime=0x1d5e6f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x790dffd0, ftCreationTime.dwHighDateTime=0x1d5e5f0, ftLastAccessTime.dwLowDateTime=0x6297ca70, ftLastAccessTime.dwHighDateTime=0x1d5e117, ftLastWriteTime.dwLowDateTime=0x6297ca70, ftLastWriteTime.dwHighDateTime=0x1d5e117, nFileSizeHigh=0x0, nFileSizeLow=0x56f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7mSuKTeWXR6I5eT.swf", cAlternateFileName="7MSUKT~1.SWF")) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cec47a0, ftCreationTime.dwHighDateTime=0x1d5e41e, ftLastAccessTime.dwLowDateTime=0x8b753400, ftLastAccessTime.dwHighDateTime=0x1d5eb76, ftLastWriteTime.dwLowDateTime=0x8b753400, ftLastWriteTime.dwHighDateTime=0x1d5eb76, nFileSizeHigh=0x0, nFileSizeLow=0x7973, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr6C9Askw3d qhMXNoO.swf", cAlternateFileName="SR6C9A~1.SWF")) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VAiXlftvNFz8IyND55", cAlternateFileName="VAIXLF~1")) returned 1 [0077.099] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3e9710, ftCreationTime.dwHighDateTime=0x1d5e254, ftLastAccessTime.dwLowDateTime=0x610a0c40, ftLastAccessTime.dwHighDateTime=0x1d5e38d, ftLastWriteTime.dwLowDateTime=0x610a0c40, ftLastWriteTime.dwHighDateTime=0x1d5e38d, nFileSizeHigh=0x0, nFileSizeLow=0x1156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WW0nBKhKm.swf", cAlternateFileName="WW0NBK~1.SWF")) returned 1 [0077.099] FindNextFileW (in: hFindFile=0x12ccf18, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed3e9710, ftCreationTime.dwHighDateTime=0x1d5e254, ftLastAccessTime.dwLowDateTime=0x610a0c40, ftLastAccessTime.dwHighDateTime=0x1d5e38d, ftLastWriteTime.dwLowDateTime=0x610a0c40, ftLastWriteTime.dwHighDateTime=0x1d5e38d, nFileSizeHigh=0x0, nFileSizeLow=0x1156a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WW0nBKhKm.swf", cAlternateFileName="WW0NBK~1.SWF")) returned 0 [0077.099] FindClose (in: hFindFile=0x12ccf18 | out: hFindFile=0x12ccf18) returned 1 [0077.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0077.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0077.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0077.099] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55", lpFilePart=0x0) returned 0x2f [0077.099] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd058 [0077.099] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ek1mI9 Pm6CUdeUWF", cAlternateFileName="7EK1MI~1")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eddb5a0, ftCreationTime.dwHighDateTime=0x1d5efa3, ftLastAccessTime.dwLowDateTime=0xe73c9460, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0xe73c9460, ftLastWriteTime.dwHighDateTime=0x1d5e9e4, nFileSizeHigh=0x0, nFileSizeLow=0x8247, dwReserved0=0x0, dwReserved1=0x0, cFileName="DT6HsLzN4.flv", cAlternateFileName="DT6HSL~1.FLV")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c802860, ftCreationTime.dwHighDateTime=0x1d5ee6a, ftLastAccessTime.dwLowDateTime=0x59058800, ftLastAccessTime.dwHighDateTime=0x1d5e147, ftLastWriteTime.dwLowDateTime=0x59058800, ftLastWriteTime.dwHighDateTime=0x1d5e147, nFileSizeHigh=0x0, nFileSizeLow=0x87b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FtQocsH I.swf", cAlternateFileName="FTQOCS~1.SWF")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220be690, ftCreationTime.dwHighDateTime=0x1d5f0c0, ftLastAccessTime.dwLowDateTime=0x56c8ad40, ftLastAccessTime.dwHighDateTime=0x1d5ef72, ftLastWriteTime.dwLowDateTime=0x56c8ad40, ftLastWriteTime.dwHighDateTime=0x1d5ef72, nFileSizeHigh=0x0, nFileSizeLow=0x1114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J aCcSK.mkv", cAlternateFileName="JACCSK~1.MKV")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616dbc20, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0xeee0f610, ftLastAccessTime.dwHighDateTime=0x1d5e99f, ftLastWriteTime.dwLowDateTime=0xeee0f610, ftLastWriteTime.dwHighDateTime=0x1d5e99f, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MnGKPK5.avi", cAlternateFileName="")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252bc240, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xdd601170, ftLastAccessTime.dwHighDateTime=0x1d5e2e0, ftLastWriteTime.dwLowDateTime=0xdd601170, ftLastWriteTime.dwHighDateTime=0x1d5e2e0, nFileSizeHigh=0x0, nFileSizeLow=0xabe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="QKPjYqzPtHvpQRyXD.mp4", cAlternateFileName="QKPJYQ~1.MP4")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82a530, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x9233c4c0, ftLastAccessTime.dwHighDateTime=0x1d5e6ab, ftLastWriteTime.dwLowDateTime=0x9233c4c0, ftLastWriteTime.dwHighDateTime=0x1d5e6ab, nFileSizeHigh=0x0, nFileSizeLow=0xc76d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zt6L72cqZX3WzmFTsWBl.flv", cAlternateFileName="ZT6L72~1.FLV")) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.100] FindClose (in: hFindFile=0x12cd058 | out: hFindFile=0x12cd058) returned 1 [0077.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0077.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0077.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0077.101] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55", lpFilePart=0x0) returned 0x2f [0077.101] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd058 [0077.101] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56c2de70, ftCreationTime.dwHighDateTime=0x1d5e3cd, ftLastAccessTime.dwLowDateTime=0x874336a0, ftLastAccessTime.dwHighDateTime=0x1d5eb14, ftLastWriteTime.dwLowDateTime=0x874336a0, ftLastWriteTime.dwHighDateTime=0x1d5eb14, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.101] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ek1mI9 Pm6CUdeUWF", cAlternateFileName="7EK1MI~1")) returned 1 [0077.101] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eddb5a0, ftCreationTime.dwHighDateTime=0x1d5efa3, ftLastAccessTime.dwLowDateTime=0xe73c9460, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0xe73c9460, ftLastWriteTime.dwHighDateTime=0x1d5e9e4, nFileSizeHigh=0x0, nFileSizeLow=0x8247, dwReserved0=0x0, dwReserved1=0x0, cFileName="DT6HsLzN4.flv", cAlternateFileName="DT6HSL~1.FLV")) returned 1 [0077.101] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c802860, ftCreationTime.dwHighDateTime=0x1d5ee6a, ftLastAccessTime.dwLowDateTime=0x59058800, ftLastAccessTime.dwHighDateTime=0x1d5e147, ftLastWriteTime.dwLowDateTime=0x59058800, ftLastWriteTime.dwHighDateTime=0x1d5e147, nFileSizeHigh=0x0, nFileSizeLow=0x87b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FtQocsH I.swf", cAlternateFileName="FTQOCS~1.SWF")) returned 1 [0077.101] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220be690, ftCreationTime.dwHighDateTime=0x1d5f0c0, ftLastAccessTime.dwLowDateTime=0x56c8ad40, ftLastAccessTime.dwHighDateTime=0x1d5ef72, ftLastWriteTime.dwLowDateTime=0x56c8ad40, ftLastWriteTime.dwHighDateTime=0x1d5ef72, nFileSizeHigh=0x0, nFileSizeLow=0x1114, dwReserved0=0x0, dwReserved1=0x0, cFileName="J aCcSK.mkv", cAlternateFileName="JACCSK~1.MKV")) returned 1 [0077.102] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616dbc20, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0xeee0f610, ftLastAccessTime.dwHighDateTime=0x1d5e99f, ftLastWriteTime.dwLowDateTime=0xeee0f610, ftLastWriteTime.dwHighDateTime=0x1d5e99f, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MnGKPK5.avi", cAlternateFileName="")) returned 1 [0077.102] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252bc240, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xdd601170, ftLastAccessTime.dwHighDateTime=0x1d5e2e0, ftLastWriteTime.dwLowDateTime=0xdd601170, ftLastWriteTime.dwHighDateTime=0x1d5e2e0, nFileSizeHigh=0x0, nFileSizeLow=0xabe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="QKPjYqzPtHvpQRyXD.mp4", cAlternateFileName="QKPJYQ~1.MP4")) returned 1 [0077.102] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82a530, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x9233c4c0, ftLastAccessTime.dwHighDateTime=0x1d5e6ab, ftLastWriteTime.dwLowDateTime=0x9233c4c0, ftLastWriteTime.dwHighDateTime=0x1d5e6ab, nFileSizeHigh=0x0, nFileSizeLow=0xc76d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zt6L72cqZX3WzmFTsWBl.flv", cAlternateFileName="ZT6L72~1.FLV")) returned 1 [0077.102] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82a530, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x9233c4c0, ftLastAccessTime.dwHighDateTime=0x1d5e6ab, ftLastWriteTime.dwLowDateTime=0x9233c4c0, ftLastWriteTime.dwHighDateTime=0x1d5e6ab, nFileSizeHigh=0x0, nFileSizeLow=0xc76d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zt6L72cqZX3WzmFTsWBl.flv", cAlternateFileName="ZT6L72~1.FLV")) returned 0 [0077.102] FindClose (in: hFindFile=0x12cd058 | out: hFindFile=0x12cd058) returned 1 [0077.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0077.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0077.102] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", lpFilePart=0x0) returned 0x3d [0077.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0077.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\dt6hslzn4.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.103] GetFileType (hFile=0x260) returned 0x1 [0077.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0077.103] GetFileType (hFile=0x260) returned 0x1 [0077.103] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x8247 [0077.103] ReadFile (in: hFile=0x260, lpBuffer=0x2ee4180, nNumberOfBytesToRead=0x8247, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2ee4180*, lpNumberOfBytesRead=0xefebd8*=0x8247, lpOverlapped=0x0) returned 1 [0077.103] CloseHandle (hObject=0x260) returned 1 [0077.118] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", lpFilePart=0x0) returned 0x3d [0077.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0077.118] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\dt6hslzn4.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.119] GetFileType (hFile=0x260) returned 0x1 [0077.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0077.119] GetFileType (hFile=0x260) returned 0x1 [0077.120] WriteFile (in: hFile=0x260, lpBuffer=0x2f59afc*, nNumberOfBytesToWrite=0x8250, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f59afc*, lpNumberOfBytesWritten=0xefebcc*=0x8250, lpOverlapped=0x0) returned 1 [0077.121] CloseHandle (hObject=0x260) returned 1 [0077.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv", lpFilePart=0x0) returned 0x3d [0077.122] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv.wholocked", lpFilePart=0x0) returned 0x47 [0077.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0077.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\dt6hslzn4.flv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eddb5a0, ftCreationTime.dwHighDateTime=0x1d5efa3, ftLastAccessTime.dwLowDateTime=0xe73c9460, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x4f615d6c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8250)) returned 1 [0077.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0077.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\dt6hslzn4.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\DT6HsLzN4.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\dt6hslzn4.flv.wholocked")) returned 1 [0077.123] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", lpFilePart=0x0) returned 0x3b [0077.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0077.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\j accsk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.123] GetFileType (hFile=0x260) returned 0x1 [0077.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0077.123] GetFileType (hFile=0x260) returned 0x1 [0077.123] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x1114 [0077.124] ReadFile (in: hFile=0x260, lpBuffer=0x2f62158, nNumberOfBytesToRead=0x1114, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f62158*, lpNumberOfBytesRead=0xefebd8*=0x1114, lpOverlapped=0x0) returned 1 [0077.124] CloseHandle (hObject=0x260) returned 1 [0077.186] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", lpFilePart=0x0) returned 0x3b [0077.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0077.186] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\j accsk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.189] GetFileType (hFile=0x260) returned 0x1 [0077.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0077.189] GetFileType (hFile=0x260) returned 0x1 [0077.189] WriteFile (in: hFile=0x260, lpBuffer=0x2fb44e0*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2fb44e0*, lpNumberOfBytesWritten=0xefebcc*=0x1120, lpOverlapped=0x0) returned 1 [0077.190] CloseHandle (hObject=0x260) returned 1 [0077.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv", lpFilePart=0x0) returned 0x3b [0077.191] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv.wholocked", lpFilePart=0x0) returned 0x45 [0077.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0077.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\j accsk.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220be690, ftCreationTime.dwHighDateTime=0x1d5f0c0, ftLastAccessTime.dwLowDateTime=0x56c8ad40, ftLastAccessTime.dwHighDateTime=0x1d5ef72, ftLastWriteTime.dwLowDateTime=0x4f6ae6b6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x1120)) returned 1 [0077.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0077.191] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\j accsk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\J aCcSK.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\j accsk.mkv.wholocked")) returned 1 [0077.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", lpFilePart=0x0) returned 0x3b [0077.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0077.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\mngkpk5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.192] GetFileType (hFile=0x260) returned 0x1 [0077.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0077.192] GetFileType (hFile=0x260) returned 0x1 [0077.192] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x931a [0077.193] ReadFile (in: hFile=0x260, lpBuffer=0x2fb59e0, nNumberOfBytesToRead=0x931a, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2fb59e0*, lpNumberOfBytesRead=0xefebd8*=0x931a, lpOverlapped=0x0) returned 1 [0077.193] CloseHandle (hObject=0x260) returned 1 [0077.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", lpFilePart=0x0) returned 0x3b [0077.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0077.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\mngkpk5.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.489] GetFileType (hFile=0x260) returned 0x1 [0077.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0077.489] GetFileType (hFile=0x260) returned 0x1 [0077.489] WriteFile (in: hFile=0x260, lpBuffer=0x2e3ae18*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e3ae18*, lpNumberOfBytesWritten=0xefebcc*=0x9320, lpOverlapped=0x0) returned 1 [0077.490] CloseHandle (hObject=0x260) returned 1 [0077.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi", lpFilePart=0x0) returned 0x3b [0077.492] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi.wholocked", lpFilePart=0x0) returned 0x45 [0077.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0077.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\mngkpk5.avi"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616dbc20, ftCreationTime.dwHighDateTime=0x1d5e727, ftLastAccessTime.dwLowDateTime=0xeee0f610, ftLastAccessTime.dwHighDateTime=0x1d5e99f, ftLastWriteTime.dwLowDateTime=0x4f97caf5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x9320)) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0077.492] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\mngkpk5.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\MnGKPK5.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\mngkpk5.avi.wholocked")) returned 1 [0077.493] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", lpFilePart=0x0) returned 0x45 [0077.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0077.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\qkpjyqzpthvpqryxd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.493] GetFileType (hFile=0x260) returned 0x1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0077.493] GetFileType (hFile=0x260) returned 0x1 [0077.494] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xabe6 [0077.494] ReadFile (in: hFile=0x260, lpBuffer=0x2e44540, nNumberOfBytesToRead=0xabe6, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e44540*, lpNumberOfBytesRead=0xefebd8*=0xabe6, lpOverlapped=0x0) returned 1 [0077.494] CloseHandle (hObject=0x260) returned 1 [0077.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", lpFilePart=0x0) returned 0x45 [0077.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0077.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\qkpjyqzpthvpqryxd.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.558] GetFileType (hFile=0x260) returned 0x1 [0077.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0077.558] GetFileType (hFile=0x260) returned 0x1 [0077.558] WriteFile (in: hFile=0x260, lpBuffer=0x2eb186c*, nNumberOfBytesToWrite=0xabf0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eb186c*, lpNumberOfBytesWritten=0xefebcc*=0xabf0, lpOverlapped=0x0) returned 1 [0077.559] CloseHandle (hObject=0x260) returned 1 [0077.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4", lpFilePart=0x0) returned 0x45 [0077.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4.wholocked", lpFilePart=0x0) returned 0x4f [0077.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0077.561] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\qkpjyqzpthvpqryxd.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252bc240, ftCreationTime.dwHighDateTime=0x1d5e3dd, ftLastAccessTime.dwLowDateTime=0xdd601170, ftLastAccessTime.dwHighDateTime=0x1d5e2e0, ftLastWriteTime.dwLowDateTime=0x4fa3b711, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xabf0)) returned 1 [0077.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0077.561] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\qkpjyqzpthvpqryxd.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\QKPjYqzPtHvpQRyXD.mp4.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\qkpjyqzpthvpqryxd.mp4.wholocked")) returned 1 [0077.561] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", lpFilePart=0x0) returned 0x48 [0077.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0077.562] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\zt6l72cqzx3wzmftswbl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.562] GetFileType (hFile=0x260) returned 0x1 [0077.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0077.562] GetFileType (hFile=0x260) returned 0x1 [0077.562] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0xc76d [0077.562] ReadFile (in: hFile=0x260, lpBuffer=0x2ebc8d8, nNumberOfBytesToRead=0xc76d, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2ebc8d8*, lpNumberOfBytesRead=0xefebd8*=0xc76d, lpOverlapped=0x0) returned 1 [0077.562] CloseHandle (hObject=0x260) returned 1 [0077.579] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", lpFilePart=0x0) returned 0x48 [0077.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0077.579] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\zt6l72cqzx3wzmftswbl.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.580] GetFileType (hFile=0x260) returned 0x1 [0077.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0077.580] GetFileType (hFile=0x260) returned 0x1 [0077.580] WriteFile (in: hFile=0x260, lpBuffer=0x2f2ed28*, nNumberOfBytesToWrite=0xc770, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f2ed28*, lpNumberOfBytesWritten=0xefebcc*=0xc770, lpOverlapped=0x0) returned 1 [0077.581] CloseHandle (hObject=0x260) returned 1 [0077.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv", lpFilePart=0x0) returned 0x48 [0077.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv.wholocked", lpFilePart=0x0) returned 0x52 [0077.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0077.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\zt6l72cqzx3wzmftswbl.flv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c82a530, ftCreationTime.dwHighDateTime=0x1d5ef96, ftLastAccessTime.dwLowDateTime=0x9233c4c0, ftLastAccessTime.dwHighDateTime=0x1d5e6ab, ftLastWriteTime.dwLowDateTime=0x4fa61ba0, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xc770)) returned 1 [0077.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0077.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\zt6l72cqzx3wzmftswbl.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\zt6L72cqZX3WzmFTsWBl.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\zt6l72cqzx3wzmftswbl.flv.wholocked")) returned 1 [0077.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0077.584] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF", lpFilePart=0x0) returned 0x42 [0077.584] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccd98 [0077.584] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece72e10, ftCreationTime.dwHighDateTime=0x1d5ee22, ftLastAccessTime.dwLowDateTime=0xa0fb3f20, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0xa0fb3f20, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0x103fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="2gUx.swf", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57ccd50, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0xb82a9af0, ftLastAccessTime.dwHighDateTime=0x1d5edae, ftLastWriteTime.dwLowDateTime=0xb82a9af0, ftLastWriteTime.dwHighDateTime=0x1d5edae, nFileSizeHigh=0x0, nFileSizeLow=0x14b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="abozMESp7ptta.swf", cAlternateFileName="ABOZME~1.SWF")) returned 1 [0077.585] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b8db0, ftCreationTime.dwHighDateTime=0x1d5e15e, ftLastAccessTime.dwLowDateTime=0xf4ab8e10, ftLastAccessTime.dwHighDateTime=0x1d5ec20, ftLastWriteTime.dwLowDateTime=0xf4ab8e10, ftLastWriteTime.dwHighDateTime=0x1d5ec20, nFileSizeHigh=0x0, nFileSizeLow=0x8957, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3 wegoL9m7t8wynThR.mkv", cAlternateFileName="Z3WEGO~1.MKV")) returned 1 [0077.585] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c35f50, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0x89337210, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0x89337210, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x109fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIc0obzM4LLHDkaKx5j6.flv", cAlternateFileName="ZIC0OB~1.FLV")) returned 1 [0077.585] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ee2cd0, ftCreationTime.dwHighDateTime=0x1d5e807, ftLastAccessTime.dwLowDateTime=0x58955ba0, ftLastAccessTime.dwHighDateTime=0x1d5e94b, ftLastWriteTime.dwLowDateTime=0x58955ba0, ftLastWriteTime.dwHighDateTime=0x1d5e94b, nFileSizeHigh=0x0, nFileSizeLow=0x9b2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="_lpM0.swf", cAlternateFileName="")) returned 1 [0077.585] FindNextFileW (in: hFindFile=0x12ccd98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.585] FindClose (in: hFindFile=0x12ccd98 | out: hFindFile=0x12ccd98) returned 1 [0077.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0077.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0077.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf8) returned 1 [0077.585] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF", nBufferLength=0x105, lpBuffer=0xefe6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF", lpFilePart=0x0) returned 0x42 [0077.585] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\*", lpFindFileData=0xefe920 | out: lpFindFileData=0xefe920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cce98 [0077.586] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34cf9ea0, ftCreationTime.dwHighDateTime=0x1d5e23a, ftLastAccessTime.dwLowDateTime=0x9c8902b0, ftLastAccessTime.dwHighDateTime=0x1d5e8e4, ftLastWriteTime.dwLowDateTime=0x9c8902b0, ftLastWriteTime.dwHighDateTime=0x1d5e8e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.586] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece72e10, ftCreationTime.dwHighDateTime=0x1d5ee22, ftLastAccessTime.dwLowDateTime=0xa0fb3f20, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0xa0fb3f20, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0x103fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="2gUx.swf", cAlternateFileName="")) returned 1 [0077.586] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57ccd50, ftCreationTime.dwHighDateTime=0x1d5e729, ftLastAccessTime.dwLowDateTime=0xb82a9af0, ftLastAccessTime.dwHighDateTime=0x1d5edae, ftLastWriteTime.dwLowDateTime=0xb82a9af0, ftLastWriteTime.dwHighDateTime=0x1d5edae, nFileSizeHigh=0x0, nFileSizeLow=0x14b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="abozMESp7ptta.swf", cAlternateFileName="ABOZME~1.SWF")) returned 1 [0077.586] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b8db0, ftCreationTime.dwHighDateTime=0x1d5e15e, ftLastAccessTime.dwLowDateTime=0xf4ab8e10, ftLastAccessTime.dwHighDateTime=0x1d5ec20, ftLastWriteTime.dwLowDateTime=0xf4ab8e10, ftLastWriteTime.dwHighDateTime=0x1d5ec20, nFileSizeHigh=0x0, nFileSizeLow=0x8957, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z3 wegoL9m7t8wynThR.mkv", cAlternateFileName="Z3WEGO~1.MKV")) returned 1 [0077.586] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c35f50, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0x89337210, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0x89337210, ftLastWriteTime.dwHighDateTime=0x1d5e149, nFileSizeHigh=0x0, nFileSizeLow=0x109fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIc0obzM4LLHDkaKx5j6.flv", cAlternateFileName="ZIC0OB~1.FLV")) returned 1 [0077.587] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ee2cd0, ftCreationTime.dwHighDateTime=0x1d5e807, ftLastAccessTime.dwLowDateTime=0x58955ba0, ftLastAccessTime.dwHighDateTime=0x1d5e94b, ftLastWriteTime.dwLowDateTime=0x58955ba0, ftLastWriteTime.dwHighDateTime=0x1d5e94b, nFileSizeHigh=0x0, nFileSizeLow=0x9b2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="_lpM0.swf", cAlternateFileName="")) returned 1 [0077.587] FindNextFileW (in: hFindFile=0x12cce98, lpFindFileData=0xefe92c | out: lpFindFileData=0xefe92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ee2cd0, ftCreationTime.dwHighDateTime=0x1d5e807, ftLastAccessTime.dwLowDateTime=0x58955ba0, ftLastAccessTime.dwHighDateTime=0x1d5e94b, ftLastWriteTime.dwLowDateTime=0x58955ba0, ftLastWriteTime.dwHighDateTime=0x1d5e94b, nFileSizeHigh=0x0, nFileSizeLow=0x9b2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="_lpM0.swf", cAlternateFileName="")) returned 0 [0077.587] FindClose (in: hFindFile=0x12cce98 | out: hFindFile=0x12cce98) returned 1 [0077.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0077.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebc0) returned 1 [0077.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", lpFilePart=0x0) returned 0x5a [0077.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0077.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\z3 wegol9m7t8wynthr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.587] GetFileType (hFile=0x260) returned 0x1 [0077.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0077.587] GetFileType (hFile=0x260) returned 0x1 [0077.587] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x8957 [0077.587] ReadFile (in: hFile=0x260, lpBuffer=0x2f3e0b0, nNumberOfBytesToRead=0x8957, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2f3e0b0*, lpNumberOfBytesRead=0xefeb50*=0x8957, lpOverlapped=0x0) returned 1 [0077.588] CloseHandle (hObject=0x260) returned 1 [0077.660] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", lpFilePart=0x0) returned 0x5a [0077.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0077.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\z3 wegol9m7t8wynthr.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.661] GetFileType (hFile=0x260) returned 0x1 [0077.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0077.661] GetFileType (hFile=0x260) returned 0x1 [0077.661] WriteFile (in: hFile=0x260, lpBuffer=0x2fb5d7c*, nNumberOfBytesToWrite=0x8960, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2fb5d7c*, lpNumberOfBytesWritten=0xefeb44*=0x8960, lpOverlapped=0x0) returned 1 [0077.663] CloseHandle (hObject=0x260) returned 1 [0077.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv", lpFilePart=0x0) returned 0x5a [0077.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv.wholocked", lpFilePart=0x0) returned 0x64 [0077.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0077.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\z3 wegol9m7t8wynthr.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b8db0, ftCreationTime.dwHighDateTime=0x1d5e15e, ftLastAccessTime.dwLowDateTime=0xf4ab8e10, ftLastAccessTime.dwHighDateTime=0x1d5ec20, ftLastWriteTime.dwLowDateTime=0x4fb20769, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8960)) returned 1 [0077.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0077.665] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\z3 wegol9m7t8wynthr.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\Z3 wegoL9m7t8wynThR.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\z3 wegol9m7t8wynthr.mkv.wholocked")) returned 1 [0077.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", nBufferLength=0x105, lpBuffer=0xefe564, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", lpFilePart=0x0) returned 0x5b [0077.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeaa8) returned 1 [0077.665] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\zic0obzm4llhdkakx5j6.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.665] GetFileType (hFile=0x260) returned 0x1 [0077.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeaa4) returned 1 [0077.666] GetFileType (hFile=0x260) returned 0x1 [0077.666] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefeba4 | out: lpFileSizeHigh=0xefeba4*=0x0) returned 0x109fc [0077.666] ReadFile (in: hFile=0x260, lpBuffer=0x2fbec30, nNumberOfBytesToRead=0x109fc, lpNumberOfBytesRead=0xefeb50, lpOverlapped=0x0 | out: lpBuffer=0x2fbec30*, lpNumberOfBytesRead=0xefeb50*=0x109fc, lpOverlapped=0x0) returned 1 [0077.666] CloseHandle (hObject=0x260) returned 1 [0077.865] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", nBufferLength=0x105, lpBuffer=0xefe550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", lpFilePart=0x0) returned 0x5b [0077.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefea94) returned 1 [0077.865] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\zic0obzm4llhdkakx5j6.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.869] GetFileType (hFile=0x260) returned 0x1 [0077.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefea90) returned 1 [0077.869] GetFileType (hFile=0x260) returned 0x1 [0077.870] WriteFile (in: hFile=0x260, lpBuffer=0x2e615fc*, nNumberOfBytesToWrite=0x10a00, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e615fc*, lpNumberOfBytesWritten=0xefeb44*=0x10a00, lpOverlapped=0x0) returned 1 [0077.872] CloseHandle (hObject=0x260) returned 1 [0077.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv", lpFilePart=0x0) returned 0x5b [0077.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv.wholocked", lpFilePart=0x0) returned 0x65 [0077.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb28) returned 1 [0077.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\zic0obzm4llhdkakx5j6.flv"), fInfoLevelId=0x0, lpFileInformation=0xefeba4 | out: lpFileInformation=0xefeba4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c35f50, ftCreationTime.dwHighDateTime=0x1d5ed0b, ftLastAccessTime.dwLowDateTime=0x89337210, ftLastAccessTime.dwHighDateTime=0x1d5e149, ftLastWriteTime.dwLowDateTime=0x4fd3688e, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x10a00)) returned 1 [0077.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb24) returned 1 [0077.875] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\zic0obzm4llhdkakx5j6.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h-OvM\\VAiXlftvNFz8IyND55\\7ek1mI9 Pm6CUdeUWF\\zIc0obzM4LLHDkaKx5j6.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\h-ovm\\vaixlftvnfz8iynd55\\7ek1mi9 pm6cudeuwf\\zic0obzm4llhdkakx5j6.flv.wholocked")) returned 1 [0077.876] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0077.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0077.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.878] GetFileType (hFile=0x260) returned 0x1 [0077.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0077.878] GetFileType (hFile=0x260) returned 0x1 [0077.878] WriteFile (in: hFile=0x260, lpBuffer=0x2e73f2c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e73f2c*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0077.879] CloseHandle (hObject=0x260) returned 1 [0077.879] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0077.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.881] GetFileType (hFile=0x260) returned 0x1 [0077.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0077.881] GetFileType (hFile=0x260) returned 0x1 [0077.881] WriteFile (in: hFile=0x260, lpBuffer=0x2e76a78*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e76a78*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0077.882] CloseHandle (hObject=0x260) returned 1 [0077.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0077.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.946] GetFileType (hFile=0x260) returned 0x1 [0077.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0077.946] GetFileType (hFile=0x260) returned 0x1 [0077.946] WriteFile (in: hFile=0x260, lpBuffer=0x2e795c4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e795c4*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0077.947] CloseHandle (hObject=0x260) returned 1 [0077.948] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0077.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeae4) returned 1 [0077.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.949] GetFileType (hFile=0x260) returned 0x1 [0077.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeae0) returned 1 [0077.949] GetFileType (hFile=0x260) returned 0x1 [0077.949] WriteFile (in: hFile=0x260, lpBuffer=0x2e7c110*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefeb44, lpOverlapped=0x0 | out: lpBuffer=0x2e7c110*, lpNumberOfBytesWritten=0xefeb44*=0x249, lpOverlapped=0x0) returned 1 [0077.950] CloseHandle (hObject=0x260) returned 1 [0077.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0077.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0077.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.951] GetFileType (hFile=0x260) returned 0x1 [0077.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0077.951] GetFileType (hFile=0x260) returned 0x1 [0077.951] WriteFile (in: hFile=0x260, lpBuffer=0x2e7ec54*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e7ec54*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0077.952] CloseHandle (hObject=0x260) returned 1 [0077.952] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0077.952] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.953] GetFileType (hFile=0x260) returned 0x1 [0077.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0077.953] GetFileType (hFile=0x260) returned 0x1 [0077.954] WriteFile (in: hFile=0x260, lpBuffer=0x2e817a0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e817a0*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0077.954] CloseHandle (hObject=0x260) returned 1 [0077.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0077.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.955] GetFileType (hFile=0x260) returned 0x1 [0077.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0077.955] GetFileType (hFile=0x260) returned 0x1 [0077.956] WriteFile (in: hFile=0x260, lpBuffer=0x2e842ec*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e842ec*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0077.956] CloseHandle (hObject=0x260) returned 1 [0077.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0077.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0077.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.958] GetFileType (hFile=0x260) returned 0x1 [0077.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0077.958] GetFileType (hFile=0x260) returned 0x1 [0077.958] WriteFile (in: hFile=0x260, lpBuffer=0x2e86e38*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e86e38*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0077.959] CloseHandle (hObject=0x260) returned 1 [0077.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0077.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0077.959] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.960] GetFileType (hFile=0x260) returned 0x1 [0077.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0077.960] GetFileType (hFile=0x260) returned 0x1 [0077.960] WriteFile (in: hFile=0x260, lpBuffer=0x2e8997c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e8997c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0077.961] CloseHandle (hObject=0x260) returned 1 [0077.961] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0077.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.962] GetFileType (hFile=0x260) returned 0x1 [0077.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0077.962] GetFileType (hFile=0x260) returned 0x1 [0077.963] WriteFile (in: hFile=0x260, lpBuffer=0x2e8c4c8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e8c4c8*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0077.964] CloseHandle (hObject=0x260) returned 1 [0077.964] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0077.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0077.964] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.965] GetFileType (hFile=0x260) returned 0x1 [0077.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0077.965] GetFileType (hFile=0x260) returned 0x1 [0077.965] WriteFile (in: hFile=0x260, lpBuffer=0x2e8f014*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e8f014*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0077.966] CloseHandle (hObject=0x260) returned 1 [0077.966] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0077.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0077.966] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0077.967] GetFileType (hFile=0x260) returned 0x1 [0077.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0077.967] GetFileType (hFile=0x260) returned 0x1 [0077.967] WriteFile (in: hFile=0x260, lpBuffer=0x2e91b60*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e91b60*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0077.968] CloseHandle (hObject=0x260) returned 1 [0077.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0077.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA", lpFilePart=0x0) returned 0x22 [0077.969] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd0d8 [0077.969] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.969] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85a4eb0, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0x71b220d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0x71b220d0, ftLastWriteTime.dwHighDateTime=0x1d5e0fb, nFileSizeHigh=0x0, nFileSizeLow=0x62f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EKpsExKm8-EfdGAcz.flv", cAlternateFileName="EKPSEX~1.FLV")) returned 1 [0077.969] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715935e0, ftCreationTime.dwHighDateTime=0x1d5e6a2, ftLastAccessTime.dwLowDateTime=0x8028dcb0, ftLastAccessTime.dwHighDateTime=0x1d5ee9f, ftLastWriteTime.dwLowDateTime=0x8028dcb0, ftLastWriteTime.dwHighDateTime=0x1d5ee9f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hhwo7BTHpN xWc zEk.mp4", cAlternateFileName="HHWO7B~1.MP4")) returned 1 [0077.969] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf21f160, ftCreationTime.dwHighDateTime=0x1d5efcd, ftLastAccessTime.dwLowDateTime=0xe0930b20, ftLastAccessTime.dwHighDateTime=0x1d5eba2, ftLastWriteTime.dwLowDateTime=0xe0930b20, ftLastWriteTime.dwHighDateTime=0x1d5eba2, nFileSizeHigh=0x0, nFileSizeLow=0x367c, dwReserved0=0x0, dwReserved1=0x0, cFileName="kv vTK9042M3F5rDG.avi", cAlternateFileName="KVVTK9~1.AVI")) returned 1 [0077.969] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfd8c480, ftCreationTime.dwHighDateTime=0x1d5ec7b, ftLastAccessTime.dwLowDateTime=0x9349db60, ftLastAccessTime.dwHighDateTime=0x1d5f03d, ftLastWriteTime.dwLowDateTime=0x9349db60, ftLastWriteTime.dwHighDateTime=0x1d5f03d, nFileSizeHigh=0x0, nFileSizeLow=0x17da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="qEUJQyGKj9QYiFl-4i2M.flv", cAlternateFileName="QEUJQY~1.FLV")) returned 1 [0077.970] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc496f630, ftCreationTime.dwHighDateTime=0x1d5ee80, ftLastAccessTime.dwLowDateTime=0x6555b8a0, ftLastAccessTime.dwHighDateTime=0x1d5ebf1, ftLastWriteTime.dwLowDateTime=0x6555b8a0, ftLastWriteTime.dwHighDateTime=0x1d5ebf1, nFileSizeHigh=0x0, nFileSizeLow=0x9d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD0Vst7mR-uofuS.mp4", cAlternateFileName="WD0VST~1.MP4")) returned 1 [0077.970] FindNextFileW (in: hFindFile=0x12cd0d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.970] FindClose (in: hFindFile=0x12cd0d8 | out: hFindFile=0x12cd0d8) returned 1 [0077.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0077.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0077.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0077.970] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA", lpFilePart=0x0) returned 0x22 [0077.970] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd2d8 [0077.970] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe29c31e0, ftCreationTime.dwHighDateTime=0x1d5e98f, ftLastAccessTime.dwLowDateTime=0x8a3a5730, ftLastAccessTime.dwHighDateTime=0x1d5e84e, ftLastWriteTime.dwLowDateTime=0x8a3a5730, ftLastWriteTime.dwHighDateTime=0x1d5e84e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.970] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85a4eb0, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0x71b220d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0x71b220d0, ftLastWriteTime.dwHighDateTime=0x1d5e0fb, nFileSizeHigh=0x0, nFileSizeLow=0x62f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EKpsExKm8-EfdGAcz.flv", cAlternateFileName="EKPSEX~1.FLV")) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715935e0, ftCreationTime.dwHighDateTime=0x1d5e6a2, ftLastAccessTime.dwLowDateTime=0x8028dcb0, ftLastAccessTime.dwHighDateTime=0x1d5ee9f, ftLastWriteTime.dwLowDateTime=0x8028dcb0, ftLastWriteTime.dwHighDateTime=0x1d5ee9f, nFileSizeHigh=0x0, nFileSizeLow=0xd0d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hhwo7BTHpN xWc zEk.mp4", cAlternateFileName="HHWO7B~1.MP4")) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf21f160, ftCreationTime.dwHighDateTime=0x1d5efcd, ftLastAccessTime.dwLowDateTime=0xe0930b20, ftLastAccessTime.dwHighDateTime=0x1d5eba2, ftLastWriteTime.dwLowDateTime=0xe0930b20, ftLastWriteTime.dwHighDateTime=0x1d5eba2, nFileSizeHigh=0x0, nFileSizeLow=0x367c, dwReserved0=0x0, dwReserved1=0x0, cFileName="kv vTK9042M3F5rDG.avi", cAlternateFileName="KVVTK9~1.AVI")) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfd8c480, ftCreationTime.dwHighDateTime=0x1d5ec7b, ftLastAccessTime.dwLowDateTime=0x9349db60, ftLastAccessTime.dwHighDateTime=0x1d5f03d, ftLastWriteTime.dwLowDateTime=0x9349db60, ftLastWriteTime.dwHighDateTime=0x1d5f03d, nFileSizeHigh=0x0, nFileSizeLow=0x17da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="qEUJQyGKj9QYiFl-4i2M.flv", cAlternateFileName="QEUJQY~1.FLV")) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc496f630, ftCreationTime.dwHighDateTime=0x1d5ee80, ftLastAccessTime.dwLowDateTime=0x6555b8a0, ftLastAccessTime.dwHighDateTime=0x1d5ebf1, ftLastWriteTime.dwLowDateTime=0x6555b8a0, ftLastWriteTime.dwHighDateTime=0x1d5ebf1, nFileSizeHigh=0x0, nFileSizeLow=0x9d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD0Vst7mR-uofuS.mp4", cAlternateFileName="WD0VST~1.MP4")) returned 1 [0077.971] FindNextFileW (in: hFindFile=0x12cd2d8, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc496f630, ftCreationTime.dwHighDateTime=0x1d5ee80, ftLastAccessTime.dwLowDateTime=0x6555b8a0, ftLastAccessTime.dwHighDateTime=0x1d5ebf1, ftLastWriteTime.dwLowDateTime=0x6555b8a0, ftLastWriteTime.dwHighDateTime=0x1d5ebf1, nFileSizeHigh=0x0, nFileSizeLow=0x9d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="wD0Vst7mR-uofuS.mp4", cAlternateFileName="WD0VST~1.MP4")) returned 0 [0077.971] FindClose (in: hFindFile=0x12cd2d8 | out: hFindFile=0x12cd2d8) returned 1 [0077.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0077.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0077.972] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", lpFilePart=0x0) returned 0x38 [0077.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0077.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\ekpsexkm8-efdgacz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.972] GetFileType (hFile=0x260) returned 0x1 [0077.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0077.972] GetFileType (hFile=0x260) returned 0x1 [0077.972] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x62f3 [0077.972] ReadFile (in: hFile=0x260, lpBuffer=0x2e94b50, nNumberOfBytesToRead=0x62f3, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2e94b50*, lpNumberOfBytesRead=0xefec60*=0x62f3, lpOverlapped=0x0) returned 1 [0077.972] CloseHandle (hObject=0x260) returned 1 [0077.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", lpFilePart=0x0) returned 0x38 [0077.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0077.988] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\ekpsexkm8-efdgacz.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0077.989] GetFileType (hFile=0x260) returned 0x1 [0077.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0077.989] GetFileType (hFile=0x260) returned 0x1 [0077.989] WriteFile (in: hFile=0x260, lpBuffer=0x2f00998*, nNumberOfBytesToWrite=0x6300, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f00998*, lpNumberOfBytesWritten=0xefec54*=0x6300, lpOverlapped=0x0) returned 1 [0077.990] CloseHandle (hObject=0x260) returned 1 [0077.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv", lpFilePart=0x0) returned 0x38 [0077.992] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv.wholocked", lpFilePart=0x0) returned 0x42 [0077.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0077.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\ekpsexkm8-efdgacz.flv"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb85a4eb0, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0x71b220d0, ftLastAccessTime.dwHighDateTime=0x1d5e0fb, ftLastWriteTime.dwLowDateTime=0x4fe41782, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6300)) returned 1 [0077.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0077.992] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\ekpsexkm8-efdgacz.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\EKpsExKm8-EfdGAcz.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\ekpsexkm8-efdgacz.flv.wholocked")) returned 1 [0078.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", lpFilePart=0x0) returned 0x39 [0078.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\hhwo7bthpn xwc zek.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.040] GetFileType (hFile=0x260) returned 0x1 [0078.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.040] GetFileType (hFile=0x260) returned 0x1 [0078.040] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xd0d7 [0078.041] ReadFile (in: hFile=0x260, lpBuffer=0x2f07090, nNumberOfBytesToRead=0xd0d7, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f07090*, lpNumberOfBytesRead=0xefec60*=0xd0d7, lpOverlapped=0x0) returned 1 [0078.041] CloseHandle (hObject=0x260) returned 1 [0078.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", lpFilePart=0x0) returned 0x39 [0078.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\hhwo7bthpn xwc zek.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.059] GetFileType (hFile=0x260) returned 0x1 [0078.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.059] GetFileType (hFile=0x260) returned 0x1 [0078.059] WriteFile (in: hFile=0x260, lpBuffer=0x2f7b130*, nNumberOfBytesToWrite=0xd0e0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f7b130*, lpNumberOfBytesWritten=0xefec54*=0xd0e0, lpOverlapped=0x0) returned 1 [0078.060] CloseHandle (hObject=0x260) returned 1 [0078.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4", lpFilePart=0x0) returned 0x39 [0078.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4.wholocked", lpFilePart=0x0) returned 0x43 [0078.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\hhwo7bthpn xwc zek.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x715935e0, ftCreationTime.dwHighDateTime=0x1d5e6a2, ftLastAccessTime.dwLowDateTime=0x8028dcb0, ftLastAccessTime.dwHighDateTime=0x1d5ee9f, ftLastWriteTime.dwLowDateTime=0x4ff00592, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xd0e0)) returned 1 [0078.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.063] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\hhwo7bthpn xwc zek.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\Hhwo7BTHpN xWc zEk.mp4.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\hhwo7bthpn xwc zek.mp4.wholocked")) returned 1 [0078.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", lpFilePart=0x0) returned 0x38 [0078.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\kv vtk9042m3f5rdg.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.064] GetFileType (hFile=0x260) returned 0x1 [0078.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.064] GetFileType (hFile=0x260) returned 0x1 [0078.064] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x367c [0078.064] ReadFile (in: hFile=0x260, lpBuffer=0x2f88608, nNumberOfBytesToRead=0x367c, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2f88608*, lpNumberOfBytesRead=0xefec60*=0x367c, lpOverlapped=0x0) returned 1 [0078.064] CloseHandle (hObject=0x260) returned 1 [0078.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", lpFilePart=0x0) returned 0x38 [0078.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\kv vtk9042m3f5rdg.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.080] GetFileType (hFile=0x260) returned 0x1 [0078.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.080] GetFileType (hFile=0x260) returned 0x1 [0078.080] WriteFile (in: hFile=0x260, lpBuffer=0x2fe6470*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2fe6470*, lpNumberOfBytesWritten=0xefec54*=0x3680, lpOverlapped=0x0) returned 1 [0078.081] CloseHandle (hObject=0x260) returned 1 [0078.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi", lpFilePart=0x0) returned 0x38 [0078.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi.wholocked", lpFilePart=0x0) returned 0x42 [0078.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\kv vtk9042m3f5rdg.avi"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf21f160, ftCreationTime.dwHighDateTime=0x1d5efcd, ftLastAccessTime.dwLowDateTime=0xe0930b20, ftLastAccessTime.dwHighDateTime=0x1d5eba2, ftLastWriteTime.dwLowDateTime=0x4ff26a5f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x3680)) returned 1 [0078.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.082] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\kv vtk9042m3f5rdg.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\kv vTK9042M3F5rDG.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\kv vtk9042m3f5rdg.avi.wholocked")) returned 1 [0078.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", lpFilePart=0x0) returned 0x3b [0078.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\qeujqygkj9qyifl-4i2m.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.083] GetFileType (hFile=0x260) returned 0x1 [0078.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.083] GetFileType (hFile=0x260) returned 0x1 [0078.083] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x17da7 [0078.084] ReadFile (in: hFile=0x260, lpBuffer=0x3f6b370, nNumberOfBytesToRead=0x17da7, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x3f6b370*, lpNumberOfBytesRead=0xefec60*=0x17da7, lpOverlapped=0x0) returned 1 [0078.084] CloseHandle (hObject=0x260) returned 1 [0078.150] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", lpFilePart=0x0) returned 0x3b [0078.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.150] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\qeujqygkj9qyifl-4i2m.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.152] GetFileType (hFile=0x260) returned 0x1 [0078.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.152] GetFileType (hFile=0x260) returned 0x1 [0078.152] WriteFile (in: hFile=0x260, lpBuffer=0x3fe2818*, nNumberOfBytesToWrite=0x17db0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x3fe2818*, lpNumberOfBytesWritten=0xefec54*=0x17db0, lpOverlapped=0x0) returned 1 [0078.154] CloseHandle (hObject=0x260) returned 1 [0078.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv", lpFilePart=0x0) returned 0x3b [0078.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv.wholocked", lpFilePart=0x0) returned 0x45 [0078.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.157] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\qeujqygkj9qyifl-4i2m.flv"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfd8c480, ftCreationTime.dwHighDateTime=0x1d5ec7b, ftLastAccessTime.dwLowDateTime=0x9349db60, ftLastAccessTime.dwHighDateTime=0x1d5f03d, ftLastWriteTime.dwLowDateTime=0x4ffe5332, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x17db0)) returned 1 [0078.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.157] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\qeujqygkj9qyifl-4i2m.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\qEUJQyGKj9QYiFl-4i2M.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\qeujqygkj9qyifl-4i2m.flv.wholocked")) returned 1 [0078.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", lpFilePart=0x0) returned 0x36 [0078.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\wd0vst7mr-uofus.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.157] GetFileType (hFile=0x260) returned 0x1 [0078.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.158] GetFileType (hFile=0x260) returned 0x1 [0078.158] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x9d41 [0078.158] ReadFile (in: hFile=0x260, lpBuffer=0x30370ec, nNumberOfBytesToRead=0x9d41, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x30370ec*, lpNumberOfBytesRead=0xefec60*=0x9d41, lpOverlapped=0x0) returned 1 [0078.158] CloseHandle (hObject=0x260) returned 1 [0078.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", lpFilePart=0x0) returned 0x36 [0078.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\wd0vst7mr-uofus.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.179] GetFileType (hFile=0x260) returned 0x1 [0078.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.179] GetFileType (hFile=0x260) returned 0x1 [0078.179] WriteFile (in: hFile=0x260, lpBuffer=0x30b5168*, nNumberOfBytesToWrite=0x9d50, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x30b5168*, lpNumberOfBytesWritten=0xefec54*=0x9d50, lpOverlapped=0x0) returned 1 [0078.418] CloseHandle (hObject=0x260) returned 1 [0078.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4", lpFilePart=0x0) returned 0x36 [0078.420] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4.wholocked", lpFilePart=0x0) returned 0x40 [0078.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\wd0vst7mr-uofus.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc496f630, ftCreationTime.dwHighDateTime=0x1d5ee80, ftLastAccessTime.dwLowDateTime=0x6555b8a0, ftLastAccessTime.dwHighDateTime=0x1d5ebf1, ftLastWriteTime.dwLowDateTime=0x5026f9e6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x9d50)) returned 1 [0078.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.421] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\wd0vst7mr-uofus.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WW7MXwKGyuA\\wD0Vst7mR-uofuS.mp4.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ww7mxwkgyua\\wd0vst7mr-uofus.mp4.wholocked")) returned 1 [0078.422] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0078.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0078.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.423] GetFileType (hFile=0x260) returned 0x1 [0078.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0078.423] GetFileType (hFile=0x260) returned 0x1 [0078.424] WriteFile (in: hFile=0x260, lpBuffer=0x30c0ca4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x30c0ca4*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0078.424] CloseHandle (hObject=0x260) returned 1 [0078.425] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0078.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0078.425] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.426] GetFileType (hFile=0x260) returned 0x1 [0078.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0078.426] GetFileType (hFile=0x260) returned 0x1 [0078.426] WriteFile (in: hFile=0x260, lpBuffer=0x30c37f0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x30c37f0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0078.427] CloseHandle (hObject=0x260) returned 1 [0078.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0078.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0078.427] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.429] GetFileType (hFile=0x260) returned 0x1 [0078.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0078.429] GetFileType (hFile=0x260) returned 0x1 [0078.430] WriteFile (in: hFile=0x260, lpBuffer=0x30c633c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x30c633c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0078.430] CloseHandle (hObject=0x260) returned 1 [0078.431] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0078.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0078.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.432] GetFileType (hFile=0x260) returned 0x1 [0078.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0078.432] GetFileType (hFile=0x260) returned 0x1 [0078.432] WriteFile (in: hFile=0x260, lpBuffer=0x30c8e88*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x30c8e88*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0078.433] CloseHandle (hObject=0x260) returned 1 [0078.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0078.433] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK", lpFilePart=0x0) returned 0x28 [0078.433] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd058 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd429d880, ftCreationTime.dwHighDateTime=0x1d5e780, ftLastAccessTime.dwLowDateTime=0xafb35a00, ftLastAccessTime.dwHighDateTime=0x1d5ec60, ftLastWriteTime.dwLowDateTime=0xafb35a00, ftLastWriteTime.dwHighDateTime=0x1d5ec60, nFileSizeHigh=0x0, nFileSizeLow=0x6674, dwReserved0=0x0, dwReserved1=0x0, cFileName="28cDR7Fq.mp4", cAlternateFileName="")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpnN1Ajp9fA14N", cAlternateFileName="JPNN1A~1")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oQ8gSpaCFoea4", cAlternateFileName="OQ8GSP~1")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e24ece0, ftCreationTime.dwHighDateTime=0x1d5ea9b, ftLastAccessTime.dwLowDateTime=0xf64f7430, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0xf64f7430, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0xc2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="qk138js.mp4", cAlternateFileName="")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd7bb70, ftCreationTime.dwHighDateTime=0x1d5e5fd, ftLastAccessTime.dwLowDateTime=0x11353ab0, ftLastAccessTime.dwHighDateTime=0x1d5e369, ftLastWriteTime.dwLowDateTime=0x11353ab0, ftLastWriteTime.dwHighDateTime=0x1d5e369, nFileSizeHigh=0x0, nFileSizeLow=0x12a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xe0hZdYw.avi", cAlternateFileName="")) returned 1 [0078.434] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cbddbd0, ftCreationTime.dwHighDateTime=0x1d5e3e3, ftLastAccessTime.dwLowDateTime=0x5b568ab0, ftLastAccessTime.dwHighDateTime=0x1d5ef2e, ftLastWriteTime.dwLowDateTime=0x5b568ab0, ftLastWriteTime.dwHighDateTime=0x1d5ef2e, nFileSizeHigh=0x0, nFileSizeLow=0x18dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZevYMFCireBbNxi1OS.mkv", cAlternateFileName="ZEVYMF~1.MKV")) returned 1 [0078.435] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.435] FindClose (in: hFindFile=0x12cd058 | out: hFindFile=0x12cd058) returned 1 [0078.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0078.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0078.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed08) returned 1 [0078.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK", nBufferLength=0x105, lpBuffer=0xefe7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK", lpFilePart=0x0) returned 0x28 [0078.435] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\*", lpFindFileData=0xefea30 | out: lpFindFileData=0xefea30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd058 [0078.435] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de00780, ftCreationTime.dwHighDateTime=0x1d5e956, ftLastAccessTime.dwLowDateTime=0xf08308a0, ftLastAccessTime.dwHighDateTime=0x1d5e873, ftLastWriteTime.dwLowDateTime=0xf08308a0, ftLastWriteTime.dwHighDateTime=0x1d5e873, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.435] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd429d880, ftCreationTime.dwHighDateTime=0x1d5e780, ftLastAccessTime.dwLowDateTime=0xafb35a00, ftLastAccessTime.dwHighDateTime=0x1d5ec60, ftLastWriteTime.dwLowDateTime=0xafb35a00, ftLastWriteTime.dwHighDateTime=0x1d5ec60, nFileSizeHigh=0x0, nFileSizeLow=0x6674, dwReserved0=0x0, dwReserved1=0x0, cFileName="28cDR7Fq.mp4", cAlternateFileName="")) returned 1 [0078.435] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpnN1Ajp9fA14N", cAlternateFileName="JPNN1A~1")) returned 1 [0078.436] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oQ8gSpaCFoea4", cAlternateFileName="OQ8GSP~1")) returned 1 [0078.436] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e24ece0, ftCreationTime.dwHighDateTime=0x1d5ea9b, ftLastAccessTime.dwLowDateTime=0xf64f7430, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0xf64f7430, ftLastWriteTime.dwHighDateTime=0x1d5e869, nFileSizeHigh=0x0, nFileSizeLow=0xc2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="qk138js.mp4", cAlternateFileName="")) returned 1 [0078.436] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd7bb70, ftCreationTime.dwHighDateTime=0x1d5e5fd, ftLastAccessTime.dwLowDateTime=0x11353ab0, ftLastAccessTime.dwHighDateTime=0x1d5e369, ftLastWriteTime.dwLowDateTime=0x11353ab0, ftLastWriteTime.dwHighDateTime=0x1d5e369, nFileSizeHigh=0x0, nFileSizeLow=0x12a10, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xe0hZdYw.avi", cAlternateFileName="")) returned 1 [0078.436] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cbddbd0, ftCreationTime.dwHighDateTime=0x1d5e3e3, ftLastAccessTime.dwLowDateTime=0x5b568ab0, ftLastAccessTime.dwHighDateTime=0x1d5ef2e, ftLastWriteTime.dwLowDateTime=0x5b568ab0, ftLastWriteTime.dwHighDateTime=0x1d5ef2e, nFileSizeHigh=0x0, nFileSizeLow=0x18dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZevYMFCireBbNxi1OS.mkv", cAlternateFileName="ZEVYMF~1.MKV")) returned 1 [0078.436] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefea3c | out: lpFindFileData=0xefea3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cbddbd0, ftCreationTime.dwHighDateTime=0x1d5e3e3, ftLastAccessTime.dwLowDateTime=0x5b568ab0, ftLastAccessTime.dwHighDateTime=0x1d5ef2e, ftLastWriteTime.dwLowDateTime=0x5b568ab0, ftLastWriteTime.dwHighDateTime=0x1d5ef2e, nFileSizeHigh=0x0, nFileSizeLow=0x18dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZevYMFCireBbNxi1OS.mkv", cAlternateFileName="ZEVYMF~1.MKV")) returned 0 [0078.436] FindClose (in: hFindFile=0x12cd058 | out: hFindFile=0x12cd058) returned 1 [0078.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecc4) returned 1 [0078.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefecd0) returned 1 [0078.437] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", lpFilePart=0x0) returned 0x35 [0078.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\28cdr7fq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.437] GetFileType (hFile=0x260) returned 0x1 [0078.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.437] GetFileType (hFile=0x260) returned 0x1 [0078.437] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x6674 [0078.437] ReadFile (in: hFile=0x260, lpBuffer=0x30cc080, nNumberOfBytesToRead=0x6674, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x30cc080*, lpNumberOfBytesRead=0xefec60*=0x6674, lpOverlapped=0x0) returned 1 [0078.437] CloseHandle (hObject=0x260) returned 1 [0078.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", lpFilePart=0x0) returned 0x35 [0078.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.536] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\28cdr7fq.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.537] GetFileType (hFile=0x260) returned 0x1 [0078.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.537] GetFileType (hFile=0x260) returned 0x1 [0078.537] WriteFile (in: hFile=0x260, lpBuffer=0x2e739f0*, nNumberOfBytesToWrite=0x6680, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2e739f0*, lpNumberOfBytesWritten=0xefec54*=0x6680, lpOverlapped=0x0) returned 1 [0078.538] CloseHandle (hObject=0x260) returned 1 [0078.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4", lpFilePart=0x0) returned 0x35 [0078.586] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4.wholocked", lpFilePart=0x0) returned 0x3f [0078.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\28cdr7fq.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd429d880, ftCreationTime.dwHighDateTime=0x1d5e780, ftLastAccessTime.dwLowDateTime=0xafb35a00, ftLastAccessTime.dwHighDateTime=0x1d5ec60, ftLastWriteTime.dwLowDateTime=0x504111d5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x6680)) returned 1 [0078.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.587] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\28cdr7fq.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\28cDR7Fq.mp4.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\28cdr7fq.mp4.wholocked")) returned 1 [0078.587] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", lpFilePart=0x0) returned 0x34 [0078.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\qk138js.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.588] GetFileType (hFile=0x260) returned 0x1 [0078.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.588] GetFileType (hFile=0x260) returned 0x1 [0078.588] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0xc2d5 [0078.588] ReadFile (in: hFile=0x260, lpBuffer=0x2e7a418, nNumberOfBytesToRead=0xc2d5, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2e7a418*, lpNumberOfBytesRead=0xefec60*=0xc2d5, lpOverlapped=0x0) returned 1 [0078.588] CloseHandle (hObject=0x260) returned 1 [0078.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", lpFilePart=0x0) returned 0x34 [0078.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\qk138js.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.606] GetFileType (hFile=0x260) returned 0x1 [0078.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.606] GetFileType (hFile=0x260) returned 0x1 [0078.606] WriteFile (in: hFile=0x260, lpBuffer=0x2eebc14*, nNumberOfBytesToWrite=0xc2e0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2eebc14*, lpNumberOfBytesWritten=0xefec54*=0xc2e0, lpOverlapped=0x0) returned 1 [0078.608] CloseHandle (hObject=0x260) returned 1 [0078.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4", lpFilePart=0x0) returned 0x34 [0078.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4.wholocked", lpFilePart=0x0) returned 0x3e [0078.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\qk138js.mp4"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e24ece0, ftCreationTime.dwHighDateTime=0x1d5ea9b, ftLastAccessTime.dwLowDateTime=0xf64f7430, ftLastAccessTime.dwHighDateTime=0x1d5e869, ftLastWriteTime.dwLowDateTime=0x50437817, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0xc2e0)) returned 1 [0078.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.610] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\qk138js.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\qk138js.mp4.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\qk138js.mp4.wholocked")) returned 1 [0078.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", lpFilePart=0x0) returned 0x35 [0078.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\xe0hzdyw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.611] GetFileType (hFile=0x260) returned 0x1 [0078.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.611] GetFileType (hFile=0x260) returned 0x1 [0078.611] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x12a10 [0078.611] ReadFile (in: hFile=0x260, lpBuffer=0x2ef829c, nNumberOfBytesToRead=0x12a10, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x2ef829c*, lpNumberOfBytesRead=0xefec60*=0x12a10, lpOverlapped=0x0) returned 1 [0078.611] CloseHandle (hObject=0x260) returned 1 [0078.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", lpFilePart=0x0) returned 0x35 [0078.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\xe0hzdyw.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.630] GetFileType (hFile=0x260) returned 0x1 [0078.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.630] GetFileType (hFile=0x260) returned 0x1 [0078.630] WriteFile (in: hFile=0x260, lpBuffer=0x2f7cef8*, nNumberOfBytesToWrite=0x12a20, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f7cef8*, lpNumberOfBytesWritten=0xefec54*=0x12a20, lpOverlapped=0x0) returned 1 [0078.632] CloseHandle (hObject=0x260) returned 1 [0078.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi", lpFilePart=0x0) returned 0x35 [0078.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi.wholocked", lpFilePart=0x0) returned 0x3f [0078.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\xe0hzdyw.avi"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd7bb70, ftCreationTime.dwHighDateTime=0x1d5e5fd, ftLastAccessTime.dwLowDateTime=0x11353ab0, ftLastAccessTime.dwHighDateTime=0x1d5e369, ftLastWriteTime.dwLowDateTime=0x504f6030, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x12a20)) returned 1 [0078.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.682] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\xe0hzdyw.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\Xe0hZdYw.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\xe0hzdyw.avi.wholocked")) returned 1 [0078.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", nBufferLength=0x105, lpBuffer=0xefe674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", lpFilePart=0x0) returned 0x3f [0078.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb8) returned 1 [0078.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\zevymfcirebbnxi1os.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.682] GetFileType (hFile=0x260) returned 0x1 [0078.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebb4) returned 1 [0078.682] GetFileType (hFile=0x260) returned 0x1 [0078.682] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefecb4 | out: lpFileSizeHigh=0xefecb4*=0x0) returned 0x18dca [0078.683] ReadFile (in: hFile=0x260, lpBuffer=0x4037fe8, nNumberOfBytesToRead=0x18dca, lpNumberOfBytesRead=0xefec60, lpOverlapped=0x0 | out: lpBuffer=0x4037fe8*, lpNumberOfBytesRead=0xefec60*=0x18dca, lpOverlapped=0x0) returned 1 [0078.683] CloseHandle (hObject=0x260) returned 1 [0078.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", nBufferLength=0x105, lpBuffer=0xefe660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", lpFilePart=0x0) returned 0x3f [0078.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeba4) returned 1 [0078.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\zevymfcirebbnxi1os.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.709] GetFileType (hFile=0x260) returned 0x1 [0078.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeba0) returned 1 [0078.709] GetFileType (hFile=0x260) returned 0x1 [0078.709] WriteFile (in: hFile=0x260, lpBuffer=0x4050dd0*, nNumberOfBytesToWrite=0x18dd0, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x4050dd0*, lpNumberOfBytesWritten=0xefec54*=0x18dd0, lpOverlapped=0x0) returned 1 [0078.711] CloseHandle (hObject=0x260) returned 1 [0078.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv", lpFilePart=0x0) returned 0x3f [0078.714] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe784, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv.wholocked", lpFilePart=0x0) returned 0x49 [0078.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec38) returned 1 [0078.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\zevymfcirebbnxi1os.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefecb4 | out: lpFileInformation=0xefecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cbddbd0, ftCreationTime.dwHighDateTime=0x1d5e3e3, ftLastAccessTime.dwLowDateTime=0x5b568ab0, ftLastAccessTime.dwHighDateTime=0x1d5ef2e, ftLastWriteTime.dwLowDateTime=0x50542598, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x18dd0)) returned 1 [0078.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec34) returned 1 [0078.714] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\zevymfcirebbnxi1os.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\ZevYMFCireBbNxi1OS.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\zevymfcirebbnxi1os.mkv.wholocked")) returned 1 [0078.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0078.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N", lpFilePart=0x0) returned 0x37 [0078.715] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccb58 [0078.715] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.715] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9632830, ftCreationTime.dwHighDateTime=0x1d5eaab, ftLastAccessTime.dwLowDateTime=0x8c76e420, ftLastAccessTime.dwHighDateTime=0x1d5ec48, ftLastWriteTime.dwLowDateTime=0x8c76e420, ftLastWriteTime.dwHighDateTime=0x1d5ec48, nFileSizeHigh=0x0, nFileSizeLow=0x843d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0t18eQXADqbb0Iw.avi", cAlternateFileName="0T18EQ~1.AVI")) returned 1 [0078.716] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe89a0c0, ftCreationTime.dwHighDateTime=0x1d5ec57, ftLastAccessTime.dwLowDateTime=0x627dd370, ftLastAccessTime.dwHighDateTime=0x1d5ead3, ftLastWriteTime.dwLowDateTime=0x627dd370, ftLastWriteTime.dwHighDateTime=0x1d5ead3, nFileSizeHigh=0x0, nFileSizeLow=0x2a4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="945Xbd7ThUZNM.flv", cAlternateFileName="945XBD~1.FLV")) returned 1 [0078.716] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f251e0, ftCreationTime.dwHighDateTime=0x1d5ee89, ftLastAccessTime.dwLowDateTime=0xba743be0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xba743be0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IzdTrMw-j2cvOw.swf", cAlternateFileName="IZDTRM~1.SWF")) returned 1 [0078.716] FindNextFileW (in: hFindFile=0x12ccb58, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.716] FindClose (in: hFindFile=0x12ccb58 | out: hFindFile=0x12ccb58) returned 1 [0078.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0078.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0078.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0078.716] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N", lpFilePart=0x0) returned 0x37 [0078.716] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cd058 [0078.716] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f5435f0, ftCreationTime.dwHighDateTime=0x1d5e6fc, ftLastAccessTime.dwLowDateTime=0xc3e706c0, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0xc3e706c0, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.717] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9632830, ftCreationTime.dwHighDateTime=0x1d5eaab, ftLastAccessTime.dwLowDateTime=0x8c76e420, ftLastAccessTime.dwHighDateTime=0x1d5ec48, ftLastWriteTime.dwLowDateTime=0x8c76e420, ftLastWriteTime.dwHighDateTime=0x1d5ec48, nFileSizeHigh=0x0, nFileSizeLow=0x843d, dwReserved0=0x0, dwReserved1=0x0, cFileName="0t18eQXADqbb0Iw.avi", cAlternateFileName="0T18EQ~1.AVI")) returned 1 [0078.717] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe89a0c0, ftCreationTime.dwHighDateTime=0x1d5ec57, ftLastAccessTime.dwLowDateTime=0x627dd370, ftLastAccessTime.dwHighDateTime=0x1d5ead3, ftLastWriteTime.dwLowDateTime=0x627dd370, ftLastWriteTime.dwHighDateTime=0x1d5ead3, nFileSizeHigh=0x0, nFileSizeLow=0x2a4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="945Xbd7ThUZNM.flv", cAlternateFileName="945XBD~1.FLV")) returned 1 [0078.717] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f251e0, ftCreationTime.dwHighDateTime=0x1d5ee89, ftLastAccessTime.dwLowDateTime=0xba743be0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xba743be0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IzdTrMw-j2cvOw.swf", cAlternateFileName="IZDTRM~1.SWF")) returned 1 [0078.717] FindNextFileW (in: hFindFile=0x12cd058, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27f251e0, ftCreationTime.dwHighDateTime=0x1d5ee89, ftLastAccessTime.dwLowDateTime=0xba743be0, ftLastAccessTime.dwHighDateTime=0x1d5e5a2, ftLastWriteTime.dwLowDateTime=0xba743be0, ftLastWriteTime.dwHighDateTime=0x1d5e5a2, nFileSizeHigh=0x0, nFileSizeLow=0x5f9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IzdTrMw-j2cvOw.swf", cAlternateFileName="IZDTRM~1.SWF")) returned 0 [0078.717] FindClose (in: hFindFile=0x12cd058 | out: hFindFile=0x12cd058) returned 1 [0078.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0078.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0078.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", lpFilePart=0x0) returned 0x4b [0078.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0078.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\0t18eqxadqbb0iw.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.718] GetFileType (hFile=0x260) returned 0x1 [0078.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0078.718] GetFileType (hFile=0x260) returned 0x1 [0078.718] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x843d [0078.718] ReadFile (in: hFile=0x260, lpBuffer=0x2dd0528, nNumberOfBytesToRead=0x843d, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2dd0528*, lpNumberOfBytesRead=0xefebd8*=0x843d, lpOverlapped=0x0) returned 1 [0078.718] CloseHandle (hObject=0x260) returned 1 [0078.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", lpFilePart=0x0) returned 0x4b [0078.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0078.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\0t18eqxadqbb0iw.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.813] GetFileType (hFile=0x260) returned 0x1 [0078.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0078.813] GetFileType (hFile=0x260) returned 0x1 [0078.814] WriteFile (in: hFile=0x260, lpBuffer=0x2e469cc*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e469cc*, lpNumberOfBytesWritten=0xefebcc*=0x8440, lpOverlapped=0x0) returned 1 [0078.815] CloseHandle (hObject=0x260) returned 1 [0078.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi", lpFilePart=0x0) returned 0x4b [0078.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi.wholocked", lpFilePart=0x0) returned 0x55 [0078.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0078.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\0t18eqxadqbb0iw.avi"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9632830, ftCreationTime.dwHighDateTime=0x1d5eaab, ftLastAccessTime.dwLowDateTime=0x8c76e420, ftLastAccessTime.dwHighDateTime=0x1d5ec48, ftLastWriteTime.dwLowDateTime=0x50627741, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x8440)) returned 1 [0078.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0078.817] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\0t18eqxadqbb0iw.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\0t18eQXADqbb0Iw.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\0t18eqxadqbb0iw.avi.wholocked")) returned 1 [0078.817] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", lpFilePart=0x0) returned 0x49 [0078.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0078.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\945xbd7thuznm.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.818] GetFileType (hFile=0x260) returned 0x1 [0078.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0078.818] GetFileType (hFile=0x260) returned 0x1 [0078.818] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x2a4b [0078.818] ReadFile (in: hFile=0x260, lpBuffer=0x2e4f2a4, nNumberOfBytesToRead=0x2a4b, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e4f2a4*, lpNumberOfBytesRead=0xefebd8*=0x2a4b, lpOverlapped=0x0) returned 1 [0078.818] CloseHandle (hObject=0x260) returned 1 [0078.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", lpFilePart=0x0) returned 0x49 [0078.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0078.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\945xbd7thuznm.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.892] GetFileType (hFile=0x260) returned 0x1 [0078.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0078.892] GetFileType (hFile=0x260) returned 0x1 [0078.892] WriteFile (in: hFile=0x260, lpBuffer=0x2ea9420*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ea9420*, lpNumberOfBytesWritten=0xefebcc*=0x2a50, lpOverlapped=0x0) returned 1 [0078.893] CloseHandle (hObject=0x260) returned 1 [0078.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv", lpFilePart=0x0) returned 0x49 [0078.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv.wholocked", lpFilePart=0x0) returned 0x53 [0078.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0078.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\945xbd7thuznm.flv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe89a0c0, ftCreationTime.dwHighDateTime=0x1d5ec57, ftLastAccessTime.dwLowDateTime=0x627dd370, ftLastAccessTime.dwHighDateTime=0x1d5ead3, ftLastWriteTime.dwLowDateTime=0x506e5f30, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x2a50)) returned 1 [0078.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0078.894] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\945xbd7thuznm.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\jpnN1Ajp9fA14N\\945Xbd7ThUZNM.flv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\jpnn1ajp9fa14n\\945xbd7thuznm.flv.wholocked")) returned 1 [0078.895] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0078.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0078.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.896] GetFileType (hFile=0x260) returned 0x1 [0078.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0078.896] GetFileType (hFile=0x260) returned 0x1 [0078.896] WriteFile (in: hFile=0x260, lpBuffer=0x2eadd00*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eadd00*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0078.897] CloseHandle (hObject=0x260) returned 1 [0078.897] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0078.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0078.897] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.898] GetFileType (hFile=0x260) returned 0x1 [0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0078.898] GetFileType (hFile=0x260) returned 0x1 [0078.898] WriteFile (in: hFile=0x260, lpBuffer=0x2eb084c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eb084c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0078.900] CloseHandle (hObject=0x260) returned 1 [0078.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0078.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0078.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.901] GetFileType (hFile=0x260) returned 0x1 [0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0078.901] GetFileType (hFile=0x260) returned 0x1 [0078.902] WriteFile (in: hFile=0x260, lpBuffer=0x2eb3398*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eb3398*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0078.902] CloseHandle (hObject=0x260) returned 1 [0078.903] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0078.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0078.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0078.904] GetFileType (hFile=0x260) returned 0x1 [0078.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0078.904] GetFileType (hFile=0x260) returned 0x1 [0078.904] WriteFile (in: hFile=0x260, lpBuffer=0x2eb5ee4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2eb5ee4*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0078.907] CloseHandle (hObject=0x260) returned 1 [0078.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0078.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4", lpFilePart=0x0) returned 0x36 [0078.907] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12cce18 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1795c0, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x4cb8e460, ftLastAccessTime.dwHighDateTime=0x1d5ec97, ftLastWriteTime.dwLowDateTime=0x4cb8e460, ftLastWriteTime.dwHighDateTime=0x1d5ec97, nFileSizeHigh=0x0, nFileSizeLow=0x14970, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0uwvGLqRsSDp.mkv", cAlternateFileName="A0UWVG~1.MKV")) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3ee40, ftCreationTime.dwHighDateTime=0x1d5ea8c, ftLastAccessTime.dwLowDateTime=0x4fa32680, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x4fa32680, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASJUa.avi", cAlternateFileName="")) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192c9a20, ftCreationTime.dwHighDateTime=0x1d5e3ef, ftLastAccessTime.dwLowDateTime=0x3e4c3f80, ftLastAccessTime.dwHighDateTime=0x1d5e526, ftLastWriteTime.dwLowDateTime=0x3e4c3f80, ftLastWriteTime.dwHighDateTime=0x1d5e526, nFileSizeHigh=0x0, nFileSizeLow=0x12ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPwvYF11LJIBuvOT.mkv", cAlternateFileName="FPWVYF~1.MKV")) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d09e2a0, ftCreationTime.dwHighDateTime=0x1d5ef38, ftLastAccessTime.dwLowDateTime=0xefe31250, ftLastAccessTime.dwHighDateTime=0x1d5e6b6, ftLastWriteTime.dwLowDateTime=0xefe31250, ftLastWriteTime.dwHighDateTime=0x1d5e6b6, nFileSizeHigh=0x0, nFileSizeLow=0x77dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFxeYCI2-Vo.swf", cAlternateFileName="GFXEYC~1.SWF")) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73ca8ab0, ftCreationTime.dwHighDateTime=0x1d5ef0b, ftLastAccessTime.dwLowDateTime=0x8ef9b0c0, ftLastAccessTime.dwHighDateTime=0x1d5edf0, ftLastWriteTime.dwLowDateTime=0x8ef9b0c0, ftLastWriteTime.dwHighDateTime=0x1d5edf0, nFileSizeHigh=0x0, nFileSizeLow=0x48f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTnpN.avi", cAlternateFileName="")) returned 1 [0078.909] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796cfd0, ftCreationTime.dwHighDateTime=0x1d5e7a2, ftLastAccessTime.dwLowDateTime=0x4cb625d0, ftLastAccessTime.dwHighDateTime=0x1d5ef77, ftLastWriteTime.dwLowDateTime=0x4cb625d0, ftLastWriteTime.dwHighDateTime=0x1d5ef77, nFileSizeHigh=0x0, nFileSizeLow=0x147b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTg83lWPWZCkdgb54UWV.mkv", cAlternateFileName="UTG83L~1.MKV")) returned 1 [0078.909] FindNextFileW (in: hFindFile=0x12cce18, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.909] FindClose (in: hFindFile=0x12cce18 | out: hFindFile=0x12cce18) returned 1 [0078.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0078.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0078.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec80) returned 1 [0078.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4", nBufferLength=0x105, lpBuffer=0xefe734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4", lpFilePart=0x0) returned 0x36 [0078.909] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\*", lpFindFileData=0xefe9a8 | out: lpFindFileData=0xefe9a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x12ccf98 [0078.909] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504e4f0, ftCreationTime.dwHighDateTime=0x1d5e6b8, ftLastAccessTime.dwLowDateTime=0x85310600, ftLastAccessTime.dwHighDateTime=0x1d5e612, ftLastWriteTime.dwLowDateTime=0x85310600, ftLastWriteTime.dwHighDateTime=0x1d5e612, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.909] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1795c0, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x4cb8e460, ftLastAccessTime.dwHighDateTime=0x1d5ec97, ftLastWriteTime.dwLowDateTime=0x4cb8e460, ftLastWriteTime.dwHighDateTime=0x1d5ec97, nFileSizeHigh=0x0, nFileSizeLow=0x14970, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0uwvGLqRsSDp.mkv", cAlternateFileName="A0UWVG~1.MKV")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3ee40, ftCreationTime.dwHighDateTime=0x1d5ea8c, ftLastAccessTime.dwLowDateTime=0x4fa32680, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x4fa32680, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1127c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASJUa.avi", cAlternateFileName="")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192c9a20, ftCreationTime.dwHighDateTime=0x1d5e3ef, ftLastAccessTime.dwLowDateTime=0x3e4c3f80, ftLastAccessTime.dwHighDateTime=0x1d5e526, ftLastWriteTime.dwLowDateTime=0x3e4c3f80, ftLastWriteTime.dwHighDateTime=0x1d5e526, nFileSizeHigh=0x0, nFileSizeLow=0x12ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPwvYF11LJIBuvOT.mkv", cAlternateFileName="FPWVYF~1.MKV")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d09e2a0, ftCreationTime.dwHighDateTime=0x1d5ef38, ftLastAccessTime.dwLowDateTime=0xefe31250, ftLastAccessTime.dwHighDateTime=0x1d5e6b6, ftLastWriteTime.dwLowDateTime=0xefe31250, ftLastWriteTime.dwHighDateTime=0x1d5e6b6, nFileSizeHigh=0x0, nFileSizeLow=0x77dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFxeYCI2-Vo.swf", cAlternateFileName="GFXEYC~1.SWF")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73ca8ab0, ftCreationTime.dwHighDateTime=0x1d5ef0b, ftLastAccessTime.dwLowDateTime=0x8ef9b0c0, ftLastAccessTime.dwHighDateTime=0x1d5edf0, ftLastWriteTime.dwLowDateTime=0x8ef9b0c0, ftLastWriteTime.dwHighDateTime=0x1d5edf0, nFileSizeHigh=0x0, nFileSizeLow=0x48f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTnpN.avi", cAlternateFileName="")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796cfd0, ftCreationTime.dwHighDateTime=0x1d5e7a2, ftLastAccessTime.dwLowDateTime=0x4cb625d0, ftLastAccessTime.dwHighDateTime=0x1d5ef77, ftLastWriteTime.dwLowDateTime=0x4cb625d0, ftLastWriteTime.dwHighDateTime=0x1d5ef77, nFileSizeHigh=0x0, nFileSizeLow=0x147b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTg83lWPWZCkdgb54UWV.mkv", cAlternateFileName="UTG83L~1.MKV")) returned 1 [0078.910] FindNextFileW (in: hFindFile=0x12ccf98, lpFindFileData=0xefe9b4 | out: lpFindFileData=0xefe9b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796cfd0, ftCreationTime.dwHighDateTime=0x1d5e7a2, ftLastAccessTime.dwLowDateTime=0x4cb625d0, ftLastAccessTime.dwHighDateTime=0x1d5ef77, ftLastWriteTime.dwLowDateTime=0x4cb625d0, ftLastWriteTime.dwHighDateTime=0x1d5ef77, nFileSizeHigh=0x0, nFileSizeLow=0x147b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTg83lWPWZCkdgb54UWV.mkv", cAlternateFileName="UTG83L~1.MKV")) returned 0 [0078.910] FindClose (in: hFindFile=0x12ccf98 | out: hFindFile=0x12ccf98) returned 1 [0078.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec3c) returned 1 [0078.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec48) returned 1 [0078.911] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", lpFilePart=0x0) returned 0x48 [0078.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0078.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\a0uwvglqrssdp.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.911] GetFileType (hFile=0x260) returned 0x1 [0078.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0078.911] GetFileType (hFile=0x260) returned 0x1 [0078.911] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x14970 [0078.911] ReadFile (in: hFile=0x260, lpBuffer=0x2eb9718, nNumberOfBytesToRead=0x14970, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2eb9718*, lpNumberOfBytesRead=0xefebd8*=0x14970, lpOverlapped=0x0) returned 1 [0078.912] CloseHandle (hObject=0x260) returned 1 [0078.993] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", lpFilePart=0x0) returned 0x48 [0078.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0078.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\a0uwvglqrssdp.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0078.995] GetFileType (hFile=0x260) returned 0x1 [0078.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0078.995] GetFileType (hFile=0x260) returned 0x1 [0078.995] WriteFile (in: hFile=0x260, lpBuffer=0x2f44194*, nNumberOfBytesToWrite=0x14980, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f44194*, lpNumberOfBytesWritten=0xefebcc*=0x14980, lpOverlapped=0x0) returned 1 [0078.997] CloseHandle (hObject=0x260) returned 1 [0078.999] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv", lpFilePart=0x0) returned 0x48 [0079.000] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv.wholocked", lpFilePart=0x0) returned 0x52 [0079.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0079.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\a0uwvglqrssdp.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1795c0, ftCreationTime.dwHighDateTime=0x1d5e8ff, ftLastAccessTime.dwLowDateTime=0x4cb8e460, ftLastAccessTime.dwHighDateTime=0x1d5ec97, ftLastWriteTime.dwLowDateTime=0x507f100b, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x14980)) returned 1 [0079.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0079.000] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\a0uwvglqrssdp.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\A0uwvGLqRsSDp.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\a0uwvglqrssdp.mkv.wholocked")) returned 1 [0079.001] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", lpFilePart=0x0) returned 0x40 [0079.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0079.001] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\asjua.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.001] GetFileType (hFile=0x260) returned 0x1 [0079.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0079.001] GetFileType (hFile=0x260) returned 0x1 [0079.001] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x1127c [0079.001] ReadFile (in: hFile=0x260, lpBuffer=0x2f58f78, nNumberOfBytesToRead=0x1127c, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2f58f78*, lpNumberOfBytesRead=0xefebd8*=0x1127c, lpOverlapped=0x0) returned 1 [0079.002] CloseHandle (hObject=0x260) returned 1 [0079.055] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", lpFilePart=0x0) returned 0x40 [0079.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0079.055] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\asjua.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.057] GetFileType (hFile=0x260) returned 0x1 [0079.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0079.057] GetFileType (hFile=0x260) returned 0x1 [0079.057] WriteFile (in: hFile=0x260, lpBuffer=0x2de0724*, nNumberOfBytesToWrite=0x11280, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2de0724*, lpNumberOfBytesWritten=0xefebcc*=0x11280, lpOverlapped=0x0) returned 1 [0079.059] CloseHandle (hObject=0x260) returned 1 [0079.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi", lpFilePart=0x0) returned 0x40 [0079.062] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi.wholocked", lpFilePart=0x0) returned 0x4a [0079.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0079.062] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\asjua.avi"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb3ee40, ftCreationTime.dwHighDateTime=0x1d5ea8c, ftLastAccessTime.dwLowDateTime=0x4fa32680, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x508899f6, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x11280)) returned 1 [0079.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0079.062] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\asjua.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\ASJUa.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\asjua.avi.wholocked")) returned 1 [0079.063] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", lpFilePart=0x0) returned 0x4b [0079.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0079.063] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\fpwvyf11ljibuvot.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.063] GetFileType (hFile=0x260) returned 0x1 [0079.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0079.063] GetFileType (hFile=0x260) returned 0x1 [0079.063] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x12ed [0079.063] ReadFile (in: hFile=0x260, lpBuffer=0x2df1de4, nNumberOfBytesToRead=0x12ed, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2df1de4*, lpNumberOfBytesRead=0xefebd8*=0x12ed, lpOverlapped=0x0) returned 1 [0079.063] CloseHandle (hObject=0x260) returned 1 [0079.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", lpFilePart=0x0) returned 0x4b [0079.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0079.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\fpwvyf11ljibuvot.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.162] GetFileType (hFile=0x260) returned 0x1 [0079.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0079.162] GetFileType (hFile=0x260) returned 0x1 [0079.162] WriteFile (in: hFile=0x260, lpBuffer=0x2e44bdc*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2e44bdc*, lpNumberOfBytesWritten=0xefebcc*=0x12f0, lpOverlapped=0x0) returned 1 [0079.163] CloseHandle (hObject=0x260) returned 1 [0079.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv", lpFilePart=0x0) returned 0x4b [0079.164] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv.wholocked", lpFilePart=0x0) returned 0x55 [0079.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0079.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\fpwvyf11ljibuvot.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192c9a20, ftCreationTime.dwHighDateTime=0x1d5e3ef, ftLastAccessTime.dwLowDateTime=0x3e4c3f80, ftLastAccessTime.dwHighDateTime=0x1d5e526, ftLastWriteTime.dwLowDateTime=0x5096e9c5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x12f0)) returned 1 [0079.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0079.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\fpwvyf11ljibuvot.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\FPwvYF11LJIBuvOT.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\fpwvyf11ljibuvot.mkv.wholocked")) returned 1 [0079.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", lpFilePart=0x0) returned 0x40 [0079.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0079.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\ptnpn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.166] GetFileType (hFile=0x260) returned 0x1 [0079.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0079.166] GetFileType (hFile=0x260) returned 0x1 [0079.166] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x48f0 [0079.166] ReadFile (in: hFile=0x260, lpBuffer=0x2e46360, nNumberOfBytesToRead=0x48f0, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2e46360*, lpNumberOfBytesRead=0xefebd8*=0x48f0, lpOverlapped=0x0) returned 1 [0079.166] CloseHandle (hObject=0x260) returned 1 [0079.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", lpFilePart=0x0) returned 0x40 [0079.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0079.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\ptnpn.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.488] GetFileType (hFile=0x260) returned 0x1 [0079.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0079.488] GetFileType (hFile=0x260) returned 0x1 [0079.488] WriteFile (in: hFile=0x260, lpBuffer=0x2ea9e48*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2ea9e48*, lpNumberOfBytesWritten=0xefebcc*=0x4900, lpOverlapped=0x0) returned 1 [0079.489] CloseHandle (hObject=0x260) returned 1 [0079.490] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi", lpFilePart=0x0) returned 0x40 [0079.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi.wholocked", lpFilePart=0x0) returned 0x4a [0079.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0079.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\ptnpn.avi"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73ca8ab0, ftCreationTime.dwHighDateTime=0x1d5ef0b, ftLastAccessTime.dwLowDateTime=0x8ef9b0c0, ftLastAccessTime.dwHighDateTime=0x1d5edf0, ftLastWriteTime.dwLowDateTime=0x50c8fb1c, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x4900)) returned 1 [0079.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0079.491] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\ptnpn.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\PTnpN.avi.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\ptnpn.avi.wholocked")) returned 1 [0079.491] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", nBufferLength=0x105, lpBuffer=0xefe5ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", lpFilePart=0x0) returned 0x4f [0079.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb30) returned 1 [0079.492] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\utg83lwpwzckdgb54uwv.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.492] GetFileType (hFile=0x260) returned 0x1 [0079.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb2c) returned 1 [0079.492] GetFileType (hFile=0x260) returned 0x1 [0079.492] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0xefec2c | out: lpFileSizeHigh=0xefec2c*=0x0) returned 0x147b4 [0079.492] ReadFile (in: hFile=0x260, lpBuffer=0x2eaeb98, nNumberOfBytesToRead=0x147b4, lpNumberOfBytesRead=0xefebd8, lpOverlapped=0x0 | out: lpBuffer=0x2eaeb98*, lpNumberOfBytesRead=0xefebd8*=0x147b4, lpOverlapped=0x0) returned 1 [0079.587] CloseHandle (hObject=0x260) returned 1 [0079.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", nBufferLength=0x105, lpBuffer=0xefe5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", lpFilePart=0x0) returned 0x4f [0079.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb1c) returned 1 [0079.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\utg83lwpwzckdgb54uwv.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260 [0079.606] GetFileType (hFile=0x260) returned 0x1 [0079.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb18) returned 1 [0079.606] GetFileType (hFile=0x260) returned 0x1 [0079.606] WriteFile (in: hFile=0x260, lpBuffer=0x2f390d4*, nNumberOfBytesToWrite=0x147c0, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f390d4*, lpNumberOfBytesWritten=0xefebcc*=0x147c0, lpOverlapped=0x0) returned 1 [0079.608] CloseHandle (hObject=0x260) returned 1 [0079.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv", lpFilePart=0x0) returned 0x4f [0079.610] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv.wholocked", nBufferLength=0x105, lpBuffer=0xefe6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv.wholocked", lpFilePart=0x0) returned 0x59 [0079.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebb0) returned 1 [0079.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\utg83lwpwzckdgb54uwv.mkv"), fInfoLevelId=0x0, lpFileInformation=0xefec2c | out: lpFileInformation=0xefec2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796cfd0, ftCreationTime.dwHighDateTime=0x1d5e7a2, ftLastAccessTime.dwLowDateTime=0x4cb625d0, ftLastAccessTime.dwHighDateTime=0x1d5ef77, ftLastWriteTime.dwLowDateTime=0x50dc0e0d, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x147c0)) returned 1 [0079.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebac) returned 1 [0079.610] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\utg83lwpwzckdgb54uwv.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\YSm0XsNkhPth5e1iK\\oQ8gSpaCFoea4\\UTg83lWPWZCkdgb54UWV.mkv.wholocked" (normalized: "c:\\users\\fd1hvy\\videos\\ysm0xsnkhpth5e1ik\\oq8gspacfoea4\\utg83lwpwzckdgb54uwv.mkv.wholocked")) returned 1 [0079.611] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0079.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0079.611] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.612] GetFileType (hFile=0x260) returned 0x1 [0079.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0079.612] GetFileType (hFile=0x260) returned 0x1 [0079.612] WriteFile (in: hFile=0x260, lpBuffer=0x2f4f74c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f4f74c*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0079.613] CloseHandle (hObject=0x260) returned 1 [0079.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0079.613] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.614] GetFileType (hFile=0x260) returned 0x1 [0079.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0079.614] GetFileType (hFile=0x260) returned 0x1 [0079.614] WriteFile (in: hFile=0x260, lpBuffer=0x2f52298*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f52298*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0079.615] CloseHandle (hObject=0x260) returned 1 [0079.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0079.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.616] GetFileType (hFile=0x260) returned 0x1 [0079.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0079.616] GetFileType (hFile=0x260) returned 0x1 [0079.617] WriteFile (in: hFile=0x260, lpBuffer=0x2f54de4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f54de4*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0079.618] CloseHandle (hObject=0x260) returned 1 [0079.618] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0079.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefeb6c) returned 1 [0079.618] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.619] GetFileType (hFile=0x260) returned 0x1 [0079.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefeb68) returned 1 [0079.619] GetFileType (hFile=0x260) returned 0x1 [0079.619] WriteFile (in: hFile=0x260, lpBuffer=0x2f57930*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefebcc, lpOverlapped=0x0 | out: lpBuffer=0x2f57930*, lpNumberOfBytesWritten=0xefebcc*=0x249, lpOverlapped=0x0) returned 1 [0079.620] CloseHandle (hObject=0x260) returned 1 [0079.620] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0079.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0079.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.621] GetFileType (hFile=0x260) returned 0x1 [0079.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0079.621] GetFileType (hFile=0x260) returned 0x1 [0079.621] WriteFile (in: hFile=0x260, lpBuffer=0x2f5a474*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f5a474*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0079.622] CloseHandle (hObject=0x260) returned 1 [0079.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0079.622] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.623] GetFileType (hFile=0x260) returned 0x1 [0079.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0079.623] GetFileType (hFile=0x260) returned 0x1 [0079.623] WriteFile (in: hFile=0x260, lpBuffer=0x2f5cfc0*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f5cfc0*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0079.624] CloseHandle (hObject=0x260) returned 1 [0079.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0079.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.625] GetFileType (hFile=0x260) returned 0x1 [0079.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0079.625] GetFileType (hFile=0x260) returned 0x1 [0079.626] WriteFile (in: hFile=0x260, lpBuffer=0x2f5fb0c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f5fb0c*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0079.626] CloseHandle (hObject=0x260) returned 1 [0079.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0079.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefebf4) returned 1 [0079.627] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.627] GetFileType (hFile=0x260) returned 0x1 [0079.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefebf0) returned 1 [0079.628] GetFileType (hFile=0x260) returned 0x1 [0079.628] WriteFile (in: hFile=0x260, lpBuffer=0x2f62658*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefec54, lpOverlapped=0x0 | out: lpBuffer=0x2f62658*, lpNumberOfBytesWritten=0xefec54*=0x249, lpOverlapped=0x0) returned 1 [0079.629] CloseHandle (hObject=0x260) returned 1 [0079.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0079.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.630] GetFileType (hFile=0x260) returned 0x1 [0079.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.630] GetFileType (hFile=0x260) returned 0x1 [0079.630] WriteFile (in: hFile=0x260, lpBuffer=0x2f6519c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6519c*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.631] CloseHandle (hObject=0x260) returned 1 [0079.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.632] GetFileType (hFile=0x260) returned 0x1 [0079.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.632] GetFileType (hFile=0x260) returned 0x1 [0079.632] WriteFile (in: hFile=0x260, lpBuffer=0x2f67ce8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f67ce8*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.633] CloseHandle (hObject=0x260) returned 1 [0079.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.681] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.681] GetFileType (hFile=0x260) returned 0x1 [0079.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.682] GetFileType (hFile=0x260) returned 0x1 [0079.682] WriteFile (in: hFile=0x260, lpBuffer=0x2f6a834*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6a834*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.683] CloseHandle (hObject=0x260) returned 1 [0079.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0079.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.684] GetFileType (hFile=0x260) returned 0x1 [0079.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.684] GetFileType (hFile=0x260) returned 0x1 [0079.684] WriteFile (in: hFile=0x260, lpBuffer=0x2f6d380*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6d380*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.685] CloseHandle (hObject=0x260) returned 1 [0079.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2d [0079.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.686] GetFileType (hFile=0x260) returned 0x1 [0079.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.686] GetFileType (hFile=0x260) returned 0x1 [0079.686] WriteFile (in: hFile=0x260, lpBuffer=0x2f6fec4*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f6fec4*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.687] CloseHandle (hObject=0x260) returned 1 [0079.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\downloads\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.688] GetFileType (hFile=0x260) returned 0x1 [0079.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.688] GetFileType (hFile=0x260) returned 0x1 [0079.688] WriteFile (in: hFile=0x260, lpBuffer=0x2f72a10*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f72a10*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.689] CloseHandle (hObject=0x260) returned 1 [0079.689] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2f [0079.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\documents\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.690] GetFileType (hFile=0x260) returned 0x1 [0079.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.690] GetFileType (hFile=0x260) returned 0x1 [0079.691] WriteFile (in: hFile=0x260, lpBuffer=0x2f7555c*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f7555c*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.691] CloseHandle (hObject=0x260) returned 1 [0079.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", nBufferLength=0x105, lpBuffer=0xefe738, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt", lpFilePart=0x0) returned 0x2e [0079.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefec7c) returned 1 [0079.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\READ_ME_Heyyyyyyy.txt" (normalized: "c:\\users\\fd1hvy\\pictures\\read_me_heyyyyyyy.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x260 [0079.692] GetFileType (hFile=0x260) returned 0x1 [0079.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefec78) returned 1 [0079.692] GetFileType (hFile=0x260) returned 0x1 [0079.693] WriteFile (in: hFile=0x260, lpBuffer=0x2f780a8*, nNumberOfBytesToWrite=0x249, lpNumberOfBytesWritten=0xefecdc, lpOverlapped=0x0 | out: lpBuffer=0x2f780a8*, lpNumberOfBytesWritten=0xefecdc*=0x249, lpOverlapped=0x0) returned 1 [0079.694] CloseHandle (hObject=0x260) returned 1 [0079.719] QueryPerformanceCounter (in: lpPerformanceCount=0xefed84 | out: lpPerformanceCount=0xefed84*=17536328004) returned 1 [0079.722] SetEvent (hEvent=0x35c) returned 1 [0079.724] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebb0*=0x3f8, lpdwindex=0xefe9cc | out: lpdwindex=0xefe9cc) returned 0x80010115 [0079.725] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb90*=0x3e8, lpdwindex=0xefe9ac | out: lpdwindex=0xefe9ac) returned 0x80010115 [0079.725] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb90*=0x3f0, lpdwindex=0xefe9ac | out: lpdwindex=0xefe9ac) returned 0x80010115 [0079.725] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebe4*=0x41c, lpdwindex=0xefea04 | out: lpdwindex=0xefea04) returned 0x80010115 [0079.726] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebe4*=0x424, lpdwindex=0xefea04 | out: lpdwindex=0xefea04) returned 0x80010115 [0079.726] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebe4*=0x42c, lpdwindex=0xefea04 | out: lpdwindex=0xefea04) returned 0x80010115 [0079.775] SetEvent (hEvent=0x35c) returned 1 [0079.778] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0xefebfc | out: pFixedInfo=0x0, pOutBufLen=0xefebfc) returned 0x6f [0083.793] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x12ab4d8 [0083.793] GetNetworkParams (in: pFixedInfo=0x12ab4d8, pOutBufLen=0xefebfc | out: pFixedInfo=0x12ab4d8, pOutBufLen=0xefebfc) returned 0x0 [0083.984] LocalFree (hMem=0x12ab4d8) returned 0x0 [0083.985] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x374 [0083.985] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2dc [0083.986] GetAddrInfoW (in: pNodeName="www.google.fr", pServiceName=0x0, pHints=0xefeae4*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xefea8c | out: ppResult=0xefea8c*=0x12a3eb0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.fr", ai_addr=0x12aad30*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.3"), ai_next=0x0)) returned 0 [0085.176] FreeAddrInfoW (pAddrInfo=0x12a3eb0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.fr", ai_addr=0x12aad30*(sa_family=2, sin_port=0x0, sin_addr="172.217.22.3"), ai_next=0x0)) [0085.177] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefea28*=0x52c, lpdwindex=0xefe844 | out: lpdwindex=0xefe844) returned 0x80010115 [0085.178] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.178] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.179] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0085.262] BeginPaint (in: hWnd=0x7005c, lpPaint=0xefe188 | out: lpPaint=0xefe188) returned 0x60100ce [0085.262] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefde64 | out: lpwndpl=0xefde64) returned 1 [0085.263] GetClientRect (in: hWnd=0x7005c, lpRect=0xefde10 | out: lpRect=0xefde10) returned 1 [0085.263] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0085.263] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0085.263] GetSystemMetrics (nIndex=42) returned 0 [0085.263] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefdcc4, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0085.263] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefdcc4) returned 0x11 [0085.263] GetClientRect (in: hWnd=0x7005c, lpRect=0xefdd18 | out: lpRect=0xefdd18) returned 1 [0085.263] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0085.263] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0085.263] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x120507d0 [0085.263] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0085.264] SaveDC (hdc=0x60100ce) returned 1 [0085.264] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0085.264] CreateSolidBrush (color=0xf0f0f0) returned 0x1e1007bb [0085.264] FillRect (hDC=0x60100ce, lprc=0xefdbb8, hbr=0x1e1007bb) returned 1 [0085.265] DeleteObject (ho=0x1e1007bb) returned 1 [0085.265] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0085.266] GdipCreateHalftonePalette () returned 0x6b080787 [0085.267] SelectPalette (hdc=0x60100ce, hPal=0x6b080787, bForceBkgd=1) returned 0x88000b [0085.267] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0085.267] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0085.267] GetSystemMetrics (nIndex=42) returned 0 [0085.267] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefe10c, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0085.267] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefe10c) returned 0x11 [0085.267] SelectPalette (hdc=0x60100ce, hPal=0x88000b, bForceBkgd=0) returned 0x6b080787 [0085.267] EndPaint (hWnd=0x7005c, lpPaint=0xefe184) returned 1 [0085.268] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefea28*=0x530, lpdwindex=0xefe844 | out: lpdwindex=0xefe844) returned 0x80010115 [0085.268] WSAConnect (in: s=0x374, name=0x2f7b5b0*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.22.3"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0085.291] closesocket (s=0x2dc) returned 0 [0085.302] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9ec | out: phkResult=0xefe9ec*=0x2dc) returned 0x0 [0085.303] RegQueryValueExW (in: hKey=0x2dc, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0xefea08, lpData=0x0, lpcbData=0xefea04*=0x0 | out: lpType=0xefea08*=0x0, lpData=0x0, lpcbData=0xefea04*=0x0) returned 0x2 [0085.303] RegCloseKey (hKey=0x2dc) returned 0x0 [0085.317] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9f0 | out: phkResult=0xefe9f0*=0x2dc) returned 0x0 [0085.317] RegQueryValueExW (in: hKey=0x2dc, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0xefea0c, lpData=0x0, lpcbData=0xefea08*=0x0 | out: lpType=0xefea0c*=0x0, lpData=0x0, lpcbData=0xefea08*=0x0) returned 0x2 [0085.317] RegCloseKey (hKey=0x2dc) returned 0x0 [0085.319] GetCurrentProcessId () returned 0x13d0 [0085.324] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xefe28c | out: lpLuid=0xefe28c*(LowPart=0x14, HighPart=0)) returned 1 [0085.326] GetCurrentProcess () returned 0xffffffff [0085.326] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0xefe288 | out: TokenHandle=0xefe288*=0x4a4) returned 1 [0085.326] AdjustTokenPrivileges (in: TokenHandle=0x4a4, DisableAllPrivileges=0, NewState=0x2f7e430*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0085.327] CloseHandle (hObject=0x4a4) returned 1 [0085.328] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13d0) returned 0x4a4 [0085.529] EnumProcessModules (in: hProcess=0x4a4, lphModule=0x2f7e474, cb=0x100, lpcbNeeded=0xefe9f8 | out: lphModule=0x2f7e474, lpcbNeeded=0xefe9f8) returned 1 [0085.530] EnumProcessModules (in: hProcess=0x4a4, lphModule=0x2f7e580, cb=0x200, lpcbNeeded=0xefe9f8 | out: lphModule=0x2f7e580, lpcbNeeded=0xefe9f8) returned 1 [0085.530] GetModuleInformation (in: hProcess=0x4a4, hModule=0xa80000, lpmodinfo=0x2f7e7c0, cb=0xc | out: lpmodinfo=0x2f7e7c0*(lpBaseOfDll=0xa80000, SizeOfImage=0x36000, EntryPoint=0x0)) returned 1 [0085.530] CoTaskMemAlloc (cb=0x804) returned 0x12c9e50 [0085.530] GetModuleBaseNameW (in: hProcess=0x4a4, hModule=0xa80000, lpBaseName=0x12c9e50, nSize=0x800 | out: lpBaseName="xX.exe") returned 0x6 [0085.531] CoTaskMemFree (pv=0x12c9e50) [0085.531] CoTaskMemAlloc (cb=0x804) returned 0x12c9e50 [0085.531] GetModuleFileNameExW (in: hProcess=0x4a4, hModule=0xa80000, lpFilename=0x12c9e50, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe")) returned 0x1e [0085.531] CoTaskMemFree (pv=0x12c9e50) [0085.531] CloseHandle (hObject=0x4a4) returned 1 [0085.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefe4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0085.532] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9f0 | out: phkResult=0xefe9f0*=0x0) returned 0x2 [0085.532] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9f0 | out: phkResult=0xefe9f0*=0x4a4) returned 0x0 [0085.533] RegQueryValueExW (in: hKey=0x4a4, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0xefea0c, lpData=0x0, lpcbData=0xefea08*=0x0 | out: lpType=0xefea0c*=0x0, lpData=0x0, lpcbData=0xefea08*=0x0) returned 0x2 [0085.533] RegCloseKey (hKey=0x4a4) returned 0x0 [0085.533] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9f0 | out: phkResult=0xefe9f0*=0x4a4) returned 0x0 [0085.533] RegQueryValueExW (in: hKey=0x4a4, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0xefea0c, lpData=0x0, lpcbData=0xefea08*=0x0 | out: lpType=0xefea0c*=0x0, lpData=0x0, lpcbData=0xefea08*=0x0) returned 0x2 [0085.533] RegCloseKey (hKey=0x4a4) returned 0x0 [0085.535] GetCurrentProcessId () returned 0x13d0 [0085.535] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13d0) returned 0x4a4 [0085.535] EnumProcessModules (in: hProcess=0x4a4, lphModule=0x2f81414, cb=0x100, lpcbNeeded=0xefe9f0 | out: lphModule=0x2f81414, lpcbNeeded=0xefe9f0) returned 1 [0085.536] EnumProcessModules (in: hProcess=0x4a4, lphModule=0x2f81520, cb=0x200, lpcbNeeded=0xefe9f0 | out: lphModule=0x2f81520, lpcbNeeded=0xefe9f0) returned 1 [0085.536] GetModuleInformation (in: hProcess=0x4a4, hModule=0xa80000, lpmodinfo=0x2f81760, cb=0xc | out: lpmodinfo=0x2f81760*(lpBaseOfDll=0xa80000, SizeOfImage=0x36000, EntryPoint=0x0)) returned 1 [0085.536] CoTaskMemAlloc (cb=0x804) returned 0x12c9e50 [0085.536] GetModuleBaseNameW (in: hProcess=0x4a4, hModule=0xa80000, lpBaseName=0x12c9e50, nSize=0x800 | out: lpBaseName="xX.exe") returned 0x6 [0085.536] CoTaskMemFree (pv=0x12c9e50) [0085.536] CoTaskMemAlloc (cb=0x804) returned 0x12c9e50 [0085.536] GetModuleFileNameExW (in: hProcess=0x4a4, hModule=0xa80000, lpFilename=0x12c9e50, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe")) returned 0x1e [0085.536] CoTaskMemFree (pv=0x12c9e50) [0085.536] CloseHandle (hObject=0x4a4) returned 1 [0085.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefe4ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0085.536] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9e8 | out: phkResult=0xefe9e8*=0x0) returned 0x2 [0085.536] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0xefe9e8 | out: phkResult=0xefe9e8*=0x4a4) returned 0x0 [0085.537] RegQueryValueExW (in: hKey=0x4a4, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0xefea04, lpData=0x0, lpcbData=0xefea00*=0x0 | out: lpType=0xefea04*=0x0, lpData=0x0, lpcbData=0xefea00*=0x0) returned 0x2 [0085.537] RegCloseKey (hKey=0x4a4) returned 0x0 [0085.543] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x12717e0 [0086.573] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x12717e0, dwGroupId=0x0) returned 0x0 [0086.594] LocalFree (hMem=0x12717e0) returned 0x0 [0086.594] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x12c9fa0 [0086.594] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x12c9fa0, dwGroupId=0x0) returned 0x0 [0086.594] LocalFree (hMem=0x12c9fa0) returned 0x0 [0086.780] EnumerateSecurityPackagesW (in: pcPackages=0xefea2c, ppPackageInfo=0xefe9c0 | out: pcPackages=0xefea2c, ppPackageInfo=0xefe9c0) returned 0x0 [0086.789] FreeContextBuffer (in: pvContextBuffer=0x12cc688 | out: pvContextBuffer=0x12cc688) returned 0x0 [0086.950] GetCurrentProcess () returned 0xffffffff [0086.950] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0xefe7f0 | out: TokenHandle=0xefe7f0*=0x594) returned 1 [0086.951] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x2f83df0, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0xefe844, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x2f8559c, ptsExpiry=0xefe7c8 | out: phCredential=0x2f8559c, ptsExpiry=0xefe7c8) returned 0x0 [0087.476] InitializeSecurityContextW (in: phCredential=0xefe804, phContext=0x0, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f85738, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe7fc | out: phNewContext=0x2f857a0, pOutput=0x2f85738, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe7fc) returned 0x90312 [0087.479] FreeContextBuffer (in: pvContextBuffer=0x12ae5b0 | out: pvContextBuffer=0x12ae5b0) returned 0x0 [0087.483] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0087.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0xefe844, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatãâqî\x17\x9cjðù°s(ðï", lpUsedDefaultChar=0x0) returned 21 [0087.483] GetProcAddress (hModule=0x772d0000, lpProcName="AppPolicyGetClrCompat") returned 0x74c968b0 [0087.486] AppPolicyGetClrCompat () returned 0x0 [0087.487] send (s=0x374, buf=0x2f857b4*, len=121, flags=0) returned 121 [0087.490] recv (in: s=0x374, buf=0x2f857b4, len=5, flags=0 | out: buf=0x2f857b4*) returned 5 [0087.515] recv (in: s=0x374, buf=0x2f857b9, len=63, flags=0 | out: buf=0x2f857b9*) returned 63 [0087.516] InitializeSecurityContextW (in: phCredential=0xefe75c, phContext=0xefe7ec, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f85b8c, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f85ba0, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe754 | out: phNewContext=0x2f857a0, pOutput=0x2f85ba0, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe754) returned 0x90312 [0087.516] recv (in: s=0x374, buf=0x2f85c30, len=5, flags=0 | out: buf=0x2f85c30*) returned 5 [0087.516] recv (in: s=0x374, buf=0x2f85c49, len=2348, flags=0 | out: buf=0x2f85c49*) returned 2348 [0087.517] InitializeSecurityContextW (in: phCredential=0xefe6b8, phContext=0xefe748, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f865e8, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f865fc, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe6b0 | out: phNewContext=0x2f857a0, pOutput=0x2f865fc, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe6b0) returned 0x90312 [0087.520] recv (in: s=0x374, buf=0x2f8668c, len=5, flags=0 | out: buf=0x2f8668c*) returned 5 [0087.520] recv (in: s=0x374, buf=0x2f866a5, len=113, flags=0 | out: buf=0x2f866a5*) returned 113 [0087.520] InitializeSecurityContextW (in: phCredential=0xefe614, phContext=0xefe6a4, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f86788, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f8679c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe60c | out: phNewContext=0x2f857a0, pOutput=0x2f8679c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe60c) returned 0x90312 [0087.520] recv (in: s=0x374, buf=0x2f8682c, len=5, flags=0 | out: buf=0x2f8682c*) returned 5 [0087.521] recv (in: s=0x374, buf=0x2f86845, len=4, flags=0 | out: buf=0x2f86845*) returned 4 [0087.521] InitializeSecurityContextW (in: phCredential=0xefe570, phContext=0xefe600, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f868bc, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f868d0, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe568 | out: phNewContext=0x2f857a0, pOutput=0x2f868d0, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe568) returned 0x90312 [0087.573] FreeContextBuffer (in: pvContextBuffer=0x1279188 | out: pvContextBuffer=0x1279188) returned 0x0 [0087.573] send (s=0x374, buf=0x2f8694c*, len=101, flags=0) returned 101 [0087.574] recv (in: s=0x374, buf=0x2f8694c, len=5, flags=0 | out: buf=0x2f8694c*) returned 5 [0087.602] recv (in: s=0x374, buf=0x2f869d9, len=236, flags=0 | out: buf=0x2f869d9*) returned 236 [0087.602] InitializeSecurityContextW (in: phCredential=0xefe4cc, phContext=0xefe55c, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f86b38, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f86b4c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe4c4 | out: phNewContext=0x2f857a0, pOutput=0x2f86b4c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe4c4) returned 0x90312 [0087.602] recv (in: s=0x374, buf=0x2f86bdc, len=5, flags=0 | out: buf=0x2f86bdc*) returned 5 [0087.602] recv (in: s=0x374, buf=0x2f86bf5, len=1, flags=0 | out: buf=0x2f86bf5*) returned 1 [0087.602] InitializeSecurityContextW (in: phCredential=0xefe428, phContext=0xefe4b8, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f86c68, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f86c7c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe420 | out: phNewContext=0x2f857a0, pOutput=0x2f86c7c, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe420) returned 0x90312 [0087.602] recv (in: s=0x374, buf=0x2f86d0c, len=5, flags=0 | out: buf=0x2f86d0c*) returned 5 [0087.602] recv (in: s=0x374, buf=0x2f86d25, len=48, flags=0 | out: buf=0x2f86d25*) returned 48 [0087.603] InitializeSecurityContextW (in: phCredential=0xefe384, phContext=0xefe414, pTargetName=0x2f7b668, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2f86dc8, Reserved2=0x0, phNewContext=0x2f857a0, pOutput=0x2f86ddc, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe37c | out: phNewContext=0x2f857a0, pOutput=0x2f86ddc, pfContextAttr=0x2f83dc4, ptsExpiry=0xefe37c) returned 0x0 [0088.442] QueryContextAttributesW (in: phContext=0x2f857a0, ulAttribute=0x4, pBuffer=0x2f86e88 | out: pBuffer=0x2f86e88) returned 0x0 [0088.442] QueryContextAttributesW (in: phContext=0x2f857a0, ulAttribute=0x5a, pBuffer=0x2f86ee0 | out: pBuffer=0x2f86ee0) returned 0x0 [0088.443] QueryContextAttributesW (in: phContext=0x2f857a0, ulAttribute=0x53, pBuffer=0x2f86f8c | out: pBuffer=0x2f86f8c) returned 0x0 [0088.662] CertDuplicateCertificateContext (pCertContext=0x12c24b0) returned 0x12c24b0 [0088.663] CertDuplicateStore (hCertStore=0x12b95f8) returned 0x12b95f8 [0088.663] CertEnumCertificatesInStore (hCertStore=0x12b95f8, pPrevCertContext=0x0) returned 0x12c21e0 [0088.663] CertDuplicateCertificateContext (pCertContext=0x12c21e0) returned 0x12c21e0 [0088.664] CertEnumCertificatesInStore (hCertStore=0x12b95f8, pPrevCertContext=0x12c21e0) returned 0x12c24b0 [0088.664] CertDuplicateCertificateContext (pCertContext=0x12c24b0) returned 0x12c24b0 [0088.664] CertEnumCertificatesInStore (hCertStore=0x12b95f8, pPrevCertContext=0x12c24b0) returned 0x0 [0088.664] CertCloseStore (hCertStore=0x12b95f8, dwFlags=0x0) returned 1 [0088.664] CertFreeCertificateContext (pCertContext=0x12c24b0) returned 1 [0088.674] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x12b96e8 [0088.677] CertAddCRLLinkToStore (in: hCertStore=0x12b96e8, pCrlContext=0x12c21e0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0088.678] CertAddCRLLinkToStore (in: hCertStore=0x12b96e8, pCrlContext=0x12c24b0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0088.678] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x8626fa0 [0088.681] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x12c24b0, pTime=0xefe394, hAdditionalStore=0x12b96e8, pChainPara=0xefe2d4, dwFlags=0x0, pvReserved=0x0, ppChainContext=0xefe2c8 | out: ppChainContext=0xefe2c8) returned 1 [0088.689] LocalFree (hMem=0x8626fa0) returned 0x0 [0088.689] CertDuplicateCertificateChain (pChainContext=0x12f2290) returned 0x12f2290 [0088.690] CertDuplicateCertificateContext (pCertContext=0x12c24b0) returned 0x12c24b0 [0088.690] CertDuplicateCertificateContext (pCertContext=0x12c20f0) returned 0x12c20f0 [0088.690] CertDuplicateCertificateContext (pCertContext=0x12c2000) returned 0x12c2000 [0088.690] CertFreeCertificateChain (pChainContext=0x12f2290) [0088.690] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x12f2290, pPolicyPara=0xefe474, pPolicyStatus=0xefe460 | out: pPolicyStatus=0xefe460) returned 1 [0088.691] SetLastError (dwErrCode=0x0) [0088.692] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x12f2290, pPolicyPara=0xefe4d4, pPolicyStatus=0xefe488 | out: pPolicyStatus=0xefe488) returned 1 [0088.739] CertFreeCertificateChain (pChainContext=0x12f2290) [0088.739] CertFreeCertificateContext (pCertContext=0x12c24b0) returned 1 [0088.741] CoTaskMemAlloc (cb=0x20c) returned 0x12f2290 [0088.741] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x12f2290, nSize=0x104 | out: lpBuffer="觐į澘įĀ") returned 0x0 [0088.742] CoTaskMemFree (pv=0x12f2290) [0088.742] CoTaskMemAlloc (cb=0x20c) returned 0x12f2290 [0088.742] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x12f2290, nSize=0x104 | out: lpBuffer="觐į澘įĀ") returned 0x0 [0088.742] CoTaskMemFree (pv=0x12f2290) [0088.742] CoTaskMemAlloc (cb=0x20c) returned 0x12f2290 [0088.742] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x12f2290, nSize=0x104 | out: lpBuffer="觐į澘įĀ") returned 0x0 [0088.742] CoTaskMemFree (pv=0x12f2290) [0088.742] CoTaskMemAlloc (cb=0x20c) returned 0x12f2290 [0088.742] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x12f2290, nSize=0x104 | out: lpBuffer="觐į澘įĀ") returned 0x0 [0088.742] CoTaskMemFree (pv=0x12f2290) [0088.743] EncryptMessage (in: phContext=0x2f857a0, fQOP=0x0, pMessage=0x2f8f0d0, MessageSeqNo=0x0 | out: pMessage=0x2f8f0d0) returned 0x0 [0088.744] send (s=0x374, buf=0x2f8dba8*, len=138, flags=0) returned 138 [0088.746] setsockopt (s=0x374, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0088.746] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.806] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.809] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2f9f46c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2f9f46c, pfQOP=0x0) returned 0x0 [0088.832] setsockopt (s=0x374, level=65535, optname=4102, optval="ô\x01", optlen=4) returned 0 [0088.832] QueryPerformanceCounter (in: lpPerformanceCount=0xefed74 | out: lpPerformanceCount=0xefed74*=18447433751) returned 1 [0088.832] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447439363) returned 1 [0088.835] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.835] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.835] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa302c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa302c, pfQOP=0x0) returned 0x0 [0088.835] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447748614) returned 1 [0088.836] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.836] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.836] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa314c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa314c, pfQOP=0x0) returned 0x0 [0088.836] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447773324) returned 1 [0088.836] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.836] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.836] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa326c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa326c, pfQOP=0x0) returned 0x0 [0088.836] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447796925) returned 1 [0088.836] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.836] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.836] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa338c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa338c, pfQOP=0x0) returned 0x0 [0088.836] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447820720) returned 1 [0088.836] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.836] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.836] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa34ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa34ac, pfQOP=0x0) returned 0x0 [0088.836] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447846899) returned 1 [0088.836] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.837] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.837] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa35cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa35cc, pfQOP=0x0) returned 0x0 [0088.837] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447877317) returned 1 [0088.837] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.837] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.837] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa36ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa36ec, pfQOP=0x0) returned 0x0 [0088.837] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447899689) returned 1 [0088.837] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.837] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.837] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa380c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa380c, pfQOP=0x0) returned 0x0 [0088.837] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447921892) returned 1 [0088.837] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.837] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.837] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa392c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa392c, pfQOP=0x0) returned 0x0 [0088.837] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447948504) returned 1 [0088.838] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.838] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.838] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3a4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3a4c, pfQOP=0x0) returned 0x0 [0088.838] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447971849) returned 1 [0088.838] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.838] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.838] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3b6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3b6c, pfQOP=0x0) returned 0x0 [0088.838] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18447994148) returned 1 [0088.838] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.838] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.838] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3c8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3c8c, pfQOP=0x0) returned 0x0 [0088.838] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448016184) returned 1 [0088.838] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.838] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.838] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3dac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3dac, pfQOP=0x0) returned 0x0 [0088.838] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448038350) returned 1 [0088.838] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.838] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.839] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3ecc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3ecc, pfQOP=0x0) returned 0x0 [0088.839] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448063606) returned 1 [0088.839] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.839] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.839] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa3fec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa3fec, pfQOP=0x0) returned 0x0 [0088.839] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448085898) returned 1 [0088.839] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.839] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.839] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa410c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa410c, pfQOP=0x0) returned 0x0 [0088.839] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448110792) returned 1 [0088.839] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.839] recv (in: s=0x374, buf=0x2f9b3b1, len=512, flags=0 | out: buf=0x2f9b3b1*) returned 512 [0088.839] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa422c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa422c, pfQOP=0x0) returned 0x0 [0088.839] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448142324) returned 1 [0088.840] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.840] recv (in: s=0x374, buf=0x2f9b3b1, len=208, flags=0 | out: buf=0x2f9b3b1*) returned 208 [0088.840] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa434c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa434c, pfQOP=0x0) returned 0x0 [0088.840] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448183869) returned 1 [0088.840] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.840] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.840] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa446c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa446c, pfQOP=0x0) returned 0x0 [0088.840] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448212321) returned 1 [0088.840] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.840] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.840] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa458c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa458c, pfQOP=0x0) returned 0x0 [0088.840] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448237673) returned 1 [0088.840] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.840] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.841] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa46ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa46ac, pfQOP=0x0) returned 0x0 [0088.841] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448260035) returned 1 [0088.841] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.841] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.841] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa47cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa47cc, pfQOP=0x0) returned 0x0 [0088.841] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448282194) returned 1 [0088.841] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.841] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.841] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa48ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa48ec, pfQOP=0x0) returned 0x0 [0088.841] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448304450) returned 1 [0088.841] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.841] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.841] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4a0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4a0c, pfQOP=0x0) returned 0x0 [0088.841] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448326619) returned 1 [0088.841] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.841] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.841] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4b2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4b2c, pfQOP=0x0) returned 0x0 [0088.841] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448348774) returned 1 [0088.842] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.842] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.842] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4c4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4c4c, pfQOP=0x0) returned 0x0 [0088.842] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448370858) returned 1 [0088.842] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.842] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.842] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4d6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4d6c, pfQOP=0x0) returned 0x0 [0088.842] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448393088) returned 1 [0088.842] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.842] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.842] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4e8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4e8c, pfQOP=0x0) returned 0x0 [0088.842] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448415329) returned 1 [0088.842] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.842] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.842] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa4fac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa4fac, pfQOP=0x0) returned 0x0 [0088.842] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448437568) returned 1 [0088.842] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.842] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.843] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa50cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa50cc, pfQOP=0x0) returned 0x0 [0088.843] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448459795) returned 1 [0088.843] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.843] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.843] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa51ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa51ec, pfQOP=0x0) returned 0x0 [0088.843] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448482262) returned 1 [0088.843] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.843] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.843] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa530c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa530c, pfQOP=0x0) returned 0x0 [0088.843] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448504323) returned 1 [0088.843] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.843] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.843] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa542c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa542c, pfQOP=0x0) returned 0x0 [0088.843] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448528977) returned 1 [0088.843] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.843] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.843] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa554c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa554c, pfQOP=0x0) returned 0x0 [0088.844] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448556496) returned 1 [0088.844] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.844] recv (in: s=0x374, buf=0x2f9b3b1, len=1424, flags=0 | out: buf=0x2f9b3b1*) returned 1424 [0088.844] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa566c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa566c, pfQOP=0x0) returned 0x0 [0088.844] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448579946) returned 1 [0088.844] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.844] recv (in: s=0x374, buf=0x2f9b3b1, len=480, flags=0 | out: buf=0x2f9b3b1*) returned 480 [0088.844] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa578c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa578c, pfQOP=0x0) returned 0x0 [0088.844] QueryPerformanceCounter (in: lpPerformanceCount=0xefed3c | out: lpPerformanceCount=0xefed3c*=18448603103) returned 1 [0088.844] recv (in: s=0x374, buf=0x2f9b3ac, len=5, flags=0 | out: buf=0x2f9b3ac*) returned 5 [0088.844] recv (in: s=0x374, buf=0x2f9b3b1, len=32, flags=0 | out: buf=0x2f9b3b1*) returned 32 [0088.844] DecryptMessage (in: phContext=0x2f857a0, pMessage=0x2fa58ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2fa58ac, pfQOP=0x0) returned 0x0 [0088.844] SetEvent (hEvent=0x35c) returned 1 [0088.844] QueryPerformanceCounter (in: lpPerformanceCount=0xefed60 | out: lpPerformanceCount=0xefed60*=18448647367) returned 1 [0088.851] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\ransom.jpg", nBufferLength=0x105, lpBuffer=0xefe7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\ransom.jpg", lpFilePart=0x0) returned 0x1a [0088.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefed04) returned 1 [0088.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ransom.jpg" (normalized: "c:\\users\\fd1hvy\\ransom.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x670 [0088.853] GetFileType (hFile=0x670) returned 0x1 [0088.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefed00) returned 1 [0088.853] GetFileType (hFile=0x670) returned 0x1 [0088.853] QueryPerformanceCounter (in: lpPerformanceCount=0xefed88 | out: lpPerformanceCount=0xefed88*=18449493392) returned 1 [0088.853] SetEvent (hEvent=0x35c) returned 1 [0088.854] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb90*=0x3f8, lpdwindex=0xefe9ac | out: lpdwindex=0xefe9ac) returned 0x80010115 [0088.854] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb70*=0x3e8, lpdwindex=0xefe98c | out: lpdwindex=0xefe98c) returned 0x80010115 [0088.855] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb70*=0x3f0, lpdwindex=0xefe98c | out: lpdwindex=0xefe98c) returned 0x80010115 [0088.855] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebc4*=0x41c, lpdwindex=0xefe9e4 | out: lpdwindex=0xefe9e4) returned 0x80010115 [0088.855] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebc4*=0x424, lpdwindex=0xefe9e4 | out: lpdwindex=0xefe9e4) returned 0x80010115 [0088.856] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefebc4*=0x42c, lpdwindex=0xefe9e4 | out: lpdwindex=0xefe9e4) returned 0x80010115 [0088.856] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x678 [0088.857] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x67c [0088.857] GetAddrInfoW (in: pNodeName="i.ibb.co", pServiceName=0x0, pHints=0xefeac4*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0xefea6c | out: ppResult=0xefea6c*=0x12c1ed0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="i.ibb.co", ai_addr=0x8620710*(sa_family=2, sin_port=0x0, sin_addr="51.210.112.130"), ai_next=0x12c1e30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x8620b00*(sa_family=2, sin_port=0x0, sin_addr="51.210.112.129"), ai_next=0x0))) returned 0 [0088.865] FreeAddrInfoW (pAddrInfo=0x12c1ed0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="i.ibb.co", ai_addr=0x8620710*(sa_family=2, sin_port=0x0, sin_addr="51.210.112.130"), ai_next=0x12c1e30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x8620b00*(sa_family=2, sin_port=0x0, sin_addr="51.210.112.129"), ai_next=0x0))) [0088.866] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefea08*=0x52c, lpdwindex=0xefe824 | out: lpdwindex=0xefe824) returned 0x80010115 [0088.866] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefea08*=0x530, lpdwindex=0xefe824 | out: lpdwindex=0xefe824) returned 0x80010115 [0088.866] WSAConnect (in: s=0x678, name=0x2fa7234*(sa_family=2, sin_port=0x1bb, sin_addr="51.210.112.130"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0088.894] closesocket (s=0x67c) returned 0 [0088.895] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x86261d8 [0088.895] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x86261d8, dwGroupId=0x0) returned 0x0 [0088.895] LocalFree (hMem=0x86261d8) returned 0x0 [0088.895] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x86263e8 [0088.895] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x86263e8, dwGroupId=0x0) returned 0x0 [0088.895] LocalFree (hMem=0x86263e8) returned 0x0 [0088.895] InitializeSecurityContextW (in: phCredential=0xefe7e4, phContext=0x0, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa787c, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe7dc | out: phNewContext=0x2fa78e4, pOutput=0x2fa787c, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe7dc) returned 0x90312 [0088.897] FreeContextBuffer (in: pvContextBuffer=0x12b6570 | out: pvContextBuffer=0x12b6570) returned 0x0 [0088.897] send (s=0x678, buf=0x2fa78f8*, len=116, flags=0) returned 116 [0088.897] recv (in: s=0x678, buf=0x2fa78f8, len=5, flags=0 | out: buf=0x2fa78f8*) returned 5 [0088.970] recv (in: s=0x678, buf=0x2fa78fd, len=97, flags=0 | out: buf=0x2fa78fd*) returned 97 [0088.970] InitializeSecurityContextW (in: phCredential=0xefe73c, phContext=0xefe7cc, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa7a18, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa7a2c, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe734 | out: phNewContext=0x2fa78e4, pOutput=0x2fa7a2c, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe734) returned 0x90312 [0088.970] recv (in: s=0x678, buf=0x2fa7abc, len=5, flags=0 | out: buf=0x2fa7abc*) returned 5 [0088.971] recv (in: s=0x678, buf=0x2fa7ad5, len=2607, flags=0 | out: buf=0x2fa7ad5*) returned 2607 [0088.971] InitializeSecurityContextW (in: phCredential=0xefe698, phContext=0xefe728, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa8574, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa8588, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe690 | out: phNewContext=0x2fa78e4, pOutput=0x2fa8588, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe690) returned 0x90312 [0088.972] recv (in: s=0x678, buf=0x2fa8618, len=5, flags=0 | out: buf=0x2fa8618*) returned 5 [0088.972] recv (in: s=0x678, buf=0x2fa8631, len=298, flags=0 | out: buf=0x2fa8631*) returned 298 [0088.972] InitializeSecurityContextW (in: phCredential=0xefe5f4, phContext=0xefe684, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa87cc, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa87e0, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe5ec | out: phNewContext=0x2fa78e4, pOutput=0x2fa87e0, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe5ec) returned 0x90312 [0088.972] recv (in: s=0x678, buf=0x2fa8870, len=5, flags=0 | out: buf=0x2fa8870*) returned 5 [0088.972] recv (in: s=0x678, buf=0x2fa8889, len=4, flags=0 | out: buf=0x2fa8889*) returned 4 [0088.972] InitializeSecurityContextW (in: phCredential=0xefe550, phContext=0xefe5e0, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa8900, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa8914, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe548 | out: phNewContext=0x2fa78e4, pOutput=0x2fa8914, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe548) returned 0x90312 [0089.152] FreeContextBuffer (in: pvContextBuffer=0x1279188 | out: pvContextBuffer=0x1279188) returned 0x0 [0089.152] send (s=0x678, buf=0x2fa8990*, len=101, flags=0) returned 101 [0089.154] recv (in: s=0x678, buf=0x2fa8990, len=5, flags=0 | out: buf=0x2fa8990*) returned 5 [0089.179] recv (in: s=0x678, buf=0x2fa8995, len=1, flags=0 | out: buf=0x2fa8995*) returned 1 [0089.179] InitializeSecurityContextW (in: phCredential=0xefe4ac, phContext=0xefe53c, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa8a7c, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa8a90, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe4a4 | out: phNewContext=0x2fa78e4, pOutput=0x2fa8a90, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe4a4) returned 0x90312 [0089.180] recv (in: s=0x678, buf=0x2fa8b20, len=5, flags=0 | out: buf=0x2fa8b20*) returned 5 [0089.180] recv (in: s=0x678, buf=0x2fa8b39, len=48, flags=0 | out: buf=0x2fa8b39*) returned 48 [0089.180] InitializeSecurityContextW (in: phCredential=0xefe408, phContext=0xefe498, pTargetName=0x2fa7278, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2fa8bdc, Reserved2=0x0, phNewContext=0x2fa78e4, pOutput=0x2fa8bf0, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe400 | out: phNewContext=0x2fa78e4, pOutput=0x2fa8bf0, pfContextAttr=0x2fa76c4, ptsExpiry=0xefe400) returned 0x0 [0089.182] QueryContextAttributesW (in: phContext=0x2fa78e4, ulAttribute=0x4, pBuffer=0x2fa8c80 | out: pBuffer=0x2fa8c80) returned 0x0 [0089.182] QueryContextAttributesW (in: phContext=0x2fa78e4, ulAttribute=0x5a, pBuffer=0x2fa8cbc | out: pBuffer=0x2fa8cbc) returned 0x0 [0089.182] QueryContextAttributesW (in: phContext=0x2fa78e4, ulAttribute=0x53, pBuffer=0x2fa8d08 | out: pBuffer=0x2fa8d08) returned 0x0 [0089.183] CertDuplicateCertificateContext (pCertContext=0x12c2870) returned 0x12c2870 [0089.183] CertDuplicateStore (hCertStore=0x12a2bd0) returned 0x12a2bd0 [0089.183] CertEnumCertificatesInStore (hCertStore=0x12a2bd0, pPrevCertContext=0x0) returned 0x12c2320 [0089.183] CertDuplicateCertificateContext (pCertContext=0x12c2320) returned 0x12c2320 [0089.183] CertEnumCertificatesInStore (hCertStore=0x12a2bd0, pPrevCertContext=0x12c2320) returned 0x12c2870 [0089.183] CertDuplicateCertificateContext (pCertContext=0x12c2870) returned 0x12c2870 [0089.183] CertEnumCertificatesInStore (hCertStore=0x12a2bd0, pPrevCertContext=0x12c2870) returned 0x0 [0089.183] CertCloseStore (hCertStore=0x12a2bd0, dwFlags=0x0) returned 1 [0089.183] CertFreeCertificateContext (pCertContext=0x12c2870) returned 1 [0089.184] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x12a2810 [0089.184] CertAddCRLLinkToStore (in: hCertStore=0x12a2810, pCrlContext=0x12c2320, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0089.184] CertAddCRLLinkToStore (in: hCertStore=0x12a2810, pCrlContext=0x12c2870, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0089.184] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x8626f40 [0089.184] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x12c2870, pTime=0xefe418, hAdditionalStore=0x12a2810, pChainPara=0xefe358, dwFlags=0x0, pvReserved=0x0, ppChainContext=0xefe34c | out: ppChainContext=0xefe34c) returned 1 [0089.187] LocalFree (hMem=0x8626f40) returned 0x0 [0089.187] CertDuplicateCertificateChain (pChainContext=0x12f98f8) returned 0x12f98f8 [0089.187] CertDuplicateCertificateContext (pCertContext=0x12c2870) returned 0x12c2870 [0089.187] CertDuplicateCertificateContext (pCertContext=0x12c2690) returned 0x12c2690 [0089.187] CertDuplicateCertificateContext (pCertContext=0x12c28c0) returned 0x12c28c0 [0089.187] CertFreeCertificateChain (pChainContext=0x12f98f8) [0089.187] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x12f98f8, pPolicyPara=0xefe4f8, pPolicyStatus=0xefe4e4 | out: pPolicyStatus=0xefe4e4) returned 1 [0089.187] SetLastError (dwErrCode=0x0) [0089.187] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x12f98f8, pPolicyPara=0xefe558, pPolicyStatus=0xefe50c | out: pPolicyStatus=0xefe50c) returned 1 [0089.188] CertFreeCertificateChain (pChainContext=0x12f98f8) [0089.188] CertFreeCertificateContext (pCertContext=0x12c2870) returned 1 [0089.188] EncryptMessage (in: phContext=0x2fa78e4, fQOP=0x0, pMessage=0x2fbe680, MessageSeqNo=0x0 | out: pMessage=0x2fbe680) returned 0x0 [0089.188] send (s=0x678, buf=0x2f8c790*, len=154, flags=0) returned 154 [0089.189] setsockopt (s=0x678, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0089.207] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.214] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.214] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e55284, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e55284, pfQOP=0x0) returned 0x0 [0089.217] setsockopt (s=0x678, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0089.217] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.217] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.217] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e66e0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e66e0c, pfQOP=0x0) returned 0x0 [0089.217] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.219] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.219] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.219] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e66f20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e66f20, pfQOP=0x0) returned 0x0 [0089.219] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.220] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.220] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.220] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67034, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67034, pfQOP=0x0) returned 0x0 [0089.220] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.220] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.220] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 2915 [0089.220] recv (in: s=0x678, buf=0x2df44e8, len=1213, flags=0 | out: buf=0x2df44e8*) returned 1213 [0089.236] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67148, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67148, pfQOP=0x0) returned 0x0 [0089.238] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.238] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.238] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.238] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e6725c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e6725c, pfQOP=0x0) returned 0x0 [0089.238] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.239] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.239] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.239] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67370, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67370, pfQOP=0x0) returned 0x0 [0089.239] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.239] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.239] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 2196 [0089.239] recv (in: s=0x678, buf=0x2df4219, len=1932, flags=0 | out: buf=0x2df4219*) returned 1932 [0089.241] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67484, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67484, pfQOP=0x0) returned 0x0 [0089.241] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.242] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.242] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 3903 [0089.242] recv (in: s=0x678, buf=0x2df48c4, len=225, flags=0 | out: buf=0x2df48c4*) returned 225 [0089.243] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67598, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67598, pfQOP=0x0) returned 0x0 [0089.243] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.243] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.243] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 2690 [0089.243] recv (in: s=0x678, buf=0x2df4407, len=1438, flags=0 | out: buf=0x2df4407*) returned 1438 [0089.245] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e676ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e676ac, pfQOP=0x0) returned 0x0 [0089.245] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.246] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.246] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.246] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e677c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e677c0, pfQOP=0x0) returned 0x0 [0089.246] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.246] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.246] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 264 [0089.246] recv (in: s=0x678, buf=0x2df3a8d, len=3864, flags=0 | out: buf=0x2df3a8d*) returned 3864 [0089.249] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e678d4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e678d4, pfQOP=0x0) returned 0x0 [0089.249] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.252] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.252] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.252] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e679e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e679e8, pfQOP=0x0) returned 0x0 [0089.252] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.252] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.252] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.252] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67afc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67afc, pfQOP=0x0) returned 0x0 [0089.252] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.252] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.253] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 2465 [0089.253] recv (in: s=0x678, buf=0x2df4326, len=1663, flags=0 | out: buf=0x2df4326*) returned 1663 [0089.259] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67c10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67c10, pfQOP=0x0) returned 0x0 [0089.260] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.260] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.260] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.261] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67d24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67d24, pfQOP=0x0) returned 0x0 [0089.261] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.261] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.261] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.262] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67e38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67e38, pfQOP=0x0) returned 0x0 [0089.262] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.262] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.262] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 1746 [0089.262] recv (in: s=0x678, buf=0x2df4057, len=2382, flags=0 | out: buf=0x2df4057*) returned 2382 [0089.263] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e67f4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e67f4c, pfQOP=0x0) returned 0x0 [0089.263] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.263] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.263] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 533 [0089.263] recv (in: s=0x678, buf=0x2df3b9a, len=3595, flags=0 | out: buf=0x2df3b9a*) returned 3595 [0089.267] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e68060, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e68060, pfQOP=0x0) returned 0x0 [0089.268] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.269] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.269] recv (in: s=0x678, buf=0x2df3985, len=4128, flags=0 | out: buf=0x2df3985*) returned 4128 [0089.269] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e68174, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e68174, pfQOP=0x0) returned 0x0 [0089.269] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.269] recv (in: s=0x678, buf=0x2df3980, len=5, flags=0 | out: buf=0x2df3980*) returned 5 [0089.269] recv (in: s=0x678, buf=0x2df3985, len=2576, flags=0 | out: buf=0x2df3985*) returned 2576 [0089.269] DecryptMessage (in: phContext=0x2e00374, pMessage=0x2e68288, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2e68288, pfQOP=0x0) returned 0x0 [0089.269] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0xefed48, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed48*=0x1000, lpOverlapped=0x0) returned 1 [0089.269] WriteFile (in: hFile=0x670, lpBuffer=0x2e65d78*, nNumberOfBytesToWrite=0x86d, lpNumberOfBytesWritten=0xefed28, lpOverlapped=0x0 | out: lpBuffer=0x2e65d78*, lpNumberOfBytesWritten=0xefed28*=0x86d, lpOverlapped=0x0) returned 1 [0089.270] CloseHandle (hObject=0x670) returned 1 [0089.284] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\Users\\FD1HVy\\ransom.jpg" (normalized: "c:\\users\\fd1hvy\\ransom.jpg"), fWinIni=0x3 | out: pvParam=0x2de079c) returned 1 [0089.849] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x1a, wParam=0x14, lParam=0xb4d398) returned 0x0 [0089.849] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x1a, wParam=0x14, lParam=0xb4d398) returned 0x0 [0089.935] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0xefe970, fWinIni=0x0 | out: pvParam=0xefe970) returned 1 [0089.996] PostMessageW (hWnd=0x70030, Msg=0x201a, wParam=0x14, lParam=0x12d2130) returned 1 [0089.996] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x1a, wParam=0x14, lParam=0xb4d398) returned 0x0 [0091.040] QueryPerformanceCounter (in: lpPerformanceCount=0xefed4c | out: lpPerformanceCount=0xefed4c*=18668240625) returned 1 [0091.041] SetEvent (hEvent=0x35c) returned 1 [0091.041] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb58*=0x52c, lpdwindex=0xefe974 | out: lpdwindex=0xefe974) returned 0x80010115 [0091.042] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefeb58*=0x530, lpdwindex=0xefe974 | out: lpdwindex=0xefe974) returned 0x80010115 [0091.043] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x670 [0091.043] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x594 [0091.043] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe9cc*=0x52c, lpdwindex=0xefe7ec | out: lpdwindex=0xefe7ec) returned 0x80010115 [0091.044] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0xefe9cc*=0x530, lpdwindex=0xefe7ec | out: lpdwindex=0xefe7ec) returned 0x80010115 [0091.044] WSAConnect (in: s=0x670, name=0x2e6b0e8*(sa_family=2, sin_port=0x50, sin_addr="127.0.0.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0092.261] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274d, dwLanguageId=0x0, lpBuffer=0xefe864, nSize=0x101, Arguments=0x0 | out: lpBuffer="No connection could be made because the target machine actively refused it.\r\n") returned 0x4d [0092.267] setsockopt (s=0x670, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0092.267] closesocket (s=0x670) returned 0 [0092.268] setsockopt (s=0x594, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0092.268] closesocket (s=0x594) returned 0 [0092.286] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefe83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0092.289] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x8620b18 [0092.289] LocalAlloc (uFlags=0x0, uBytes=0x72) returned 0x1279188 [0092.289] ShellExecuteExW (in: pExecInfo=0x2e6c254*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C timeout 2 && Del /Q /F C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2e6c254*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/C timeout 2 && Del /Q /F C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x7d0)) returned 1 [0099.509] LocalFree (hMem=0x8620b18) returned 0x0 [0099.509] LocalFree (hMem=0x1279188) returned 0x0 [0099.525] GetWindowThreadProcessId (in: hWnd=0x7005c, lpdwProcessId=0xefeef0 | out: lpdwProcessId=0xefeef0) returned 0x13d4 [0099.525] GetCurrentThreadId () returned 0x13d4 [0099.526] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1a0 [0099.526] PostMessageW (hWnd=0x7005c, Msg=0xc1a0, wParam=0x0, lParam=0x0) returned 1 [0099.526] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0099.526] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0099.527] GetSystemMetrics (nIndex=42) returned 0 [0099.527] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefee58, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0099.527] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefee58) returned 0x11 [0099.532] OleInitialize (pvReserved=0x0) returned 0x0 [0099.533] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0xeff41c | out: lplpMessageFilter=0xeff41c*=0x0) returned 0x0 [0099.534] PeekMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.534] IsWindowUnicode (hWnd=0x7005c) returned 1 [0099.534] GetMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.537] TranslateMessage (lpMsg=0xeff3f0) returned 0 [0099.537] DispatchMessageW (lpMsg=0xeff3f0) returned 0x0 [0099.537] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x46, wParam=0x0, lParam=0xeff144) returned 0x0 [0099.537] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x1, lParam=0xeff11c) returned 0x0 [0099.540] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x85, wParam=0x510407af, lParam=0x0) returned 0x0 [0099.541] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefee8c | out: lpwndpl=0xefee8c) returned 1 [0099.541] GetClientRect (in: hWnd=0x7005c, lpRect=0xefee38 | out: lpRect=0xefee38) returned 1 [0099.541] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0099.541] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0099.541] GetSystemMetrics (nIndex=42) returned 0 [0099.541] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefecec, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0099.541] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefecec) returned 0x11 [0099.542] GetClientRect (in: hWnd=0x7005c, lpRect=0xefed40 | out: lpRect=0xefed40) returned 1 [0099.542] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0099.542] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0099.542] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x120507d0 [0099.542] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0099.542] SaveDC (hdc=0x10105d6) returned 1 [0099.542] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0099.542] CreateSolidBrush (color=0xf0f0f0) returned 0x1f1007bb [0099.542] FillRect (hDC=0x10105d6, lprc=0xefebe0, hbr=0x1f1007bb) returned 1 [0099.542] DeleteObject (ho=0x1f1007bb) returned 1 [0099.542] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0099.543] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefee70 | out: lpwndpl=0xefee70) returned 1 [0099.543] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x47, wParam=0x0, lParam=0xeff144) returned 0x0 [0099.543] GetClientRect (in: hWnd=0x7005c, lpRect=0xefee20 | out: lpRect=0xefee20) returned 1 [0099.543] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefee20 | out: lpRect=0xefee20) returned 1 [0099.544] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x83, wParam=0x1, lParam=0xefec5c) returned 0x0 [0099.545] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x85, wParam=0x540407af, lParam=0x0) returned 0x0 [0099.546] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefe9cc | out: lpwndpl=0xefe9cc) returned 1 [0099.546] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe978 | out: lpRect=0xefe978) returned 1 [0099.546] GetWindowTextLengthW (hWnd=0x7005c) returned 17 [0099.546] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11 [0099.546] GetSystemMetrics (nIndex=42) returned 0 [0099.546] GetWindowTextW (in: hWnd=0x7005c, lpString=0xefe82c, nMaxCount=18 | out: lpString="Gendarmerie V.B.3") returned 17 [0099.546] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0xd, wParam=0x12, lParam=0xefe82c) returned 0x11 [0099.546] GetClientRect (in: hWnd=0x7005c, lpRect=0xefe880 | out: lpRect=0xefe880) returned 1 [0099.546] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0099.546] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0099.546] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x120507d0 [0099.546] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0099.547] SaveDC (hdc=0xf0105ee) returned 1 [0099.547] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0099.547] CreateSolidBrush (color=0xf0f0f0) returned 0x201007bb [0099.547] FillRect (hDC=0xf0105ee, lprc=0xefe720, hbr=0x201007bb) returned 1 [0099.547] DeleteObject (ho=0x201007bb) returned 1 [0099.547] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0099.547] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0099.547] PeekMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.547] IsWindowUnicode (hWnd=0x70036) returned 1 [0099.547] GetMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.548] TranslateMessage (lpMsg=0xeff3f0) returned 0 [0099.548] DispatchMessageW (lpMsg=0xeff3f0) returned 0x0 [0099.548] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0099.548] PeekMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.548] IsWindowUnicode (hWnd=0x70030) returned 1 [0099.548] GetMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.548] TranslateMessage (lpMsg=0xeff3f0) returned 0 [0099.548] DispatchMessageW (lpMsg=0xeff3f0) returned 0x0 [0099.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefeaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0099.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefea18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0099.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x105, lpBuffer=0xefea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x0) returned 0x1e [0099.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0xefef24) returned 1 [0099.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe"), fInfoLevelId=0x0, lpFileInformation=0xefefa0 | out: lpFileInformation=0xefefa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20155900, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x20155900, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x1ee42c00, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x31400)) returned 1 [0099.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0xefef20) returned 1 [0099.557] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpdwHandle=0xeff014 | out: lpdwHandle=0xeff014) returned 0x66c [0099.557] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\xX.exe", dwHandle=0x0, dwLen=0x66c, lpData=0x2e6d5cc | out: lpData=0x2e6d5cc) returned 1 [0099.558] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xefefe8, puLen=0xefefe4 | out: lplpBuffer=0xefefe8*=0x2e6d668, puLen=0xefefe4) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d6e0, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d710, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d754, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d784, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d7c0, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d838, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d870, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d8b8, puLen=0xefef64) returned 1 [0099.559] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d6be, puLen=0xefef64) returned 1 [0099.560] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x2e6d808, puLen=0xefef64) returned 1 [0099.560] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x0, puLen=0xefef64) returned 0 [0099.560] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0xefef68, puLen=0xefef64 | out: lplpBuffer=0xefef68*=0x0, puLen=0xefef64) returned 0 [0099.560] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xefef5c, puLen=0xefef58 | out: lplpBuffer=0xefef5c*=0x2e6d668, puLen=0xefef58) returned 1 [0099.560] VerLanguageNameW (in: wLang=0x0, szLang=0xefecec, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0099.564] VerQueryValueW (in: pBlock=0x2e6d5cc, lpSubBlock="\\", lplpBuffer=0xefef6c, puLen=0xefef68 | out: lplpBuffer=0xefef6c*=0x2e6d5f4, puLen=0xefef68) returned 1 [0099.565] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Gendarmerie_B\\Gendarmerie B.V.3\\1.0.0.0", ulOptions=0x0, samDesired=0x20019, phkResult=0xeff004 | out: phkResult=0xeff004*=0x0) returned 0x2 [0099.625] GetWindowThreadProcessId (in: hWnd=0x302c0, lpdwProcessId=0xeff01c | out: lpdwProcessId=0xeff01c) returned 0x13d4 [0099.625] GetCurrentThreadId () returned 0x13d4 [0099.631] GetWindowThreadProcessId (in: hWnd=0x302c0, lpdwProcessId=0xeff01c | out: lpdwProcessId=0xeff01c) returned 0x13d4 [0099.631] GetCurrentThreadId () returned 0x13d4 [0099.632] GetWindowThreadProcessId (in: hWnd=0x302c0, lpdwProcessId=0xeff01c | out: lpdwProcessId=0xeff01c) returned 0x13d4 [0099.632] GetCurrentThreadId () returned 0x13d4 [0099.633] LocalFree (hMem=0x12d2130) returned 0x0 [0099.633] NtdllDefWindowProc_W (hWnd=0x70030, Msg=0x201a, wParam=0x14, lParam=0x12d2130) returned 0x0 [0099.633] PeekMessageW (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0xeff3f0) returned 1 [0099.633] GetMessageA (in: lpMsg=0xeff3f0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0xeff3f0) returned 0 [0099.640] DestroyCursor (hCursor=0xf7020d) returned 1 [0099.641] GetWindowLongW (hWnd=0x7005c, nIndex=-20) returned 590208 [0099.641] DestroyWindow (hWnd=0x7005c) returned 1 [0099.641] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0099.641] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x46, wParam=0x0, lParam=0xeff1a4) returned 0x0 [0099.643] GetWindowPlacement (in: hWnd=0x7005c, lpwndpl=0xefeed0 | out: lpwndpl=0xefeed0) returned 1 [0099.643] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x47, wParam=0x0, lParam=0xeff1a4) returned 0x0 [0099.643] GetClientRect (in: hWnd=0x7005c, lpRect=0xefee80 | out: lpRect=0xefee80) returned 1 [0099.643] GetWindowRect (in: hWnd=0x7005c, lpRect=0xefee80 | out: lpRect=0xefee80) returned 1 [0099.644] PostThreadMessageW (idThread=0x13d4, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0099.663] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0099.663] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x7005c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0099.663] DestroyWindow (hWnd=0x70036) returned 1 [0099.663] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0099.664] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0099.664] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0099.671] GetCurrentThreadId () returned 0x13d4 [0099.671] EnumThreadWindows (dwThreadId=0x13d4, lpfn=0x54d39ee, lParam=0x0) returned 1 [0099.672] IsWindowVisible (hWnd=0x70030) returned 0 [0099.672] IsWindowVisible (hWnd=0x40068) returned 0 [0099.673] GetCurrentThreadId () returned 0x13d4 [0099.673] GetCurrentThreadId () returned 0x13d4 [0099.673] EnumThreadWindows (dwThreadId=0x13d4, lpfn=0x54d3a66, lParam=0x0) returned 1 [0099.673] IsWindowVisible (hWnd=0x70030) returned 0 [0099.673] IsWindowVisible (hWnd=0x40068) returned 0 [0099.674] OleUninitialize () [0099.675] CloseHandle (hObject=0x2f0) returned 1 [0099.675] DeactivateActCtx (dwFlags=0x0, ulCookie=0x112c0002) returned 1 [0099.679] CoGetContextToken (in: pToken=0xeffd98 | out: pToken=0xeffd98) returned 0x0 [0099.679] CObjectContext::QueryInterface () returned 0x0 [0099.679] CObjectContext::GetCurrentThreadType () returned 0x0 [0099.679] Release () returned 0x3 [0099.680] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x1222c60*=0x198, lpdwindex=0xeffc3c | out: lpdwindex=0xeffc3c) returned 0x0 Thread: id = 2 os_tid = 0x13f8 Thread: id = 3 os_tid = 0x1118 Thread: id = 4 os_tid = 0x1148 [0046.468] CoGetContextToken (in: pToken=0x4e8fae4 | out: pToken=0x4e8fae4) returned 0x800401f0 [0046.469] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0046.469] RoInitialize () returned 0x1 [0046.469] RoUninitialize () returned 0x0 [0064.980] SleepEx (dwMilliseconds=0x5, bAlertable=0) returned 0x0 [0065.055] SleepEx (dwMilliseconds=0x5, bAlertable=0) returned 0x0 [0065.074] CloseHandle (hObject=0x4a4) returned 1 [0065.074] CloseHandle (hObject=0x37c) returned 1 [0065.074] CloseHandle (hObject=0x378) returned 1 [0065.074] CloseHandle (hObject=0x4a0) returned 1 [0065.074] CloseHandle (hObject=0x374) returned 1 [0065.075] CloseHandle (hObject=0x370) returned 1 [0065.075] CloseHandle (hObject=0x488) returned 1 [0065.075] CloseHandle (hObject=0x36c) returned 1 [0065.075] CloseHandle (hObject=0x2e8) returned 1 [0065.075] CloseHandle (hObject=0x368) returned 1 [0065.075] CloseHandle (hObject=0x2e4) returned 1 [0065.075] CloseHandle (hObject=0x47c) returned 1 [0065.075] CloseHandle (hObject=0x2e0) returned 1 [0065.075] CloseHandle (hObject=0x364) returned 1 [0065.076] CloseHandle (hObject=0x2dc) returned 1 [0065.076] CloseHandle (hObject=0x2d8) returned 1 [0065.076] CloseHandle (hObject=0x358) returned 1 [0065.076] CloseHandle (hObject=0x2d4) returned 1 [0065.077] CloseHandle (hObject=0x2cc) returned 1 [0065.077] CloseHandle (hObject=0x2d0) returned 1 [0065.077] CloseHandle (hObject=0x354) returned 1 [0076.621] SleepEx (dwMilliseconds=0x5, bAlertable=0) returned 0x0 [0089.202] CertCloseStore (hCertStore=0x12b96e8, dwFlags=0x0) returned 1 [0089.203] CertFreeCertificateContext (pCertContext=0x12c24b0) returned 1 [0089.203] CertFreeCertificateContext (pCertContext=0x12c21e0) returned 1 [0089.203] CertFreeCertificateContext (pCertContext=0x12c2320) returned 1 [0089.204] CertFreeCertificateContext (pCertContext=0x12c2690) returned 1 [0089.204] CertFreeCertificateContext (pCertContext=0x12c2870) returned 1 [0089.204] CloseHandle (hObject=0x594) returned 1 [0089.205] CertFreeCertificateContext (pCertContext=0x12c28c0) returned 1 [0089.205] CertCloseStore (hCertStore=0x12a2810, dwFlags=0x0) returned 1 [0089.205] CertFreeCertificateContext (pCertContext=0x12c2870) returned 1 [0089.206] CertFreeCertificateContext (pCertContext=0x12c2000) returned 1 [0089.206] CertFreeCertificateContext (pCertContext=0x12c20f0) returned 1 [0089.207] CertFreeCertificateContext (pCertContext=0x12c24b0) returned 1 [0099.704] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=1950089536) returned 88934102 [0099.704] SetClassLongW (hWnd=0x6002e, nIndex=-24, dwNewLong=1950089536) returned 0x54d06ae [0099.705] PostMessageW (hWnd=0x6002e, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0099.705] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=1950089536) returned 88933862 [0099.705] SetClassLongW (hWnd=0x302c0, nIndex=-24, dwNewLong=1950089536) returned 0x54d05be [0099.705] PostMessageW (hWnd=0x302c0, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0099.709] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0099.710] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", hInstance=0xa80000) returned 0 [0099.710] GetModuleHandleW (lpModuleName=0x0) returned 0xa80000 [0099.710] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", hInstance=0xa80000) returned 0 [0099.711] EtwEventUnregister (RegHandle=0x1220338) returned 0x0 [0099.711] EtwEventUnregister (RegHandle=0x1285e80) returned 0x0 [0099.713] IsWindow (hWnd=0x70030) returned 1 [0099.713] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0099.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x4e8f884, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWâqî\x17\x9cjðù°s\x08ûè\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0099.714] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0099.714] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=1950089536) returned 88934022 [0099.714] SetClassLongW (hWnd=0x70030, nIndex=-24, dwNewLong=1950089536) returned 0x54d0686 [0099.714] IsWindow (hWnd=0x70030) returned 1 [0099.714] DestroyWindow (hWnd=0x70030) returned 0 [0099.714] PostMessageW (hWnd=0x70030, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0099.715] SetConsoleCtrlHandler (HandlerRoutine=0x54d065e, Add=0) returned 1 [0099.715] DeleteObject (ho=0x6b080787) returned 1 [0099.758] GdipDeleteFont (font=0x541ef48) returned 0x0 [0099.759] DeleteObject (ho=0x550a07c3) returned 1 [0099.759] DestroyCursor (hCursor=0x402ab) returned 1 [0099.761] RegCloseKey (hKey=0x418) returned 0x0 [0099.761] RegCloseKey (hKey=0x414) returned 0x0 [0099.761] WinHttpCloseHandle (hInternet=0x128ad30) returned 1 [0099.762] CloseHandle (hObject=0x7d0) returned 1 [0099.763] DeleteSecurityContext (phContext=0x2e00374) returned 0x0 [0099.764] FreeCredentialsHandle (phCredential=0x2de4d8c) returned 0x0 [0099.765] DeleteSecurityContext (phContext=0x2de4f44) returned 0x0 [0099.766] setsockopt (s=0x374, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0099.766] closesocket (s=0x374) returned 0 [0099.769] RegCloseKey (hKey=0x80000004) returned 0x0 [0099.769] CloseHandle (hObject=0x3f8) returned 1 [0099.770] setsockopt (s=0x3ec, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0099.770] closesocket (s=0x3ec) returned 0 [0099.770] CloseHandle (hObject=0x3f0) returned 1 [0099.770] setsockopt (s=0x3e4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0099.771] closesocket (s=0x3e4) returned 0 [0099.771] CloseHandle (hObject=0x3e8) returned 1 [0099.771] setsockopt (s=0x524, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0099.771] closesocket (s=0x524) returned 0 [0099.772] CloseHandle (hObject=0x530) returned 1 [0099.772] CloseHandle (hObject=0x430) returned 1 [0099.772] CloseHandle (hObject=0x42c) returned 1 [0099.772] RegCloseKey (hKey=0x428) returned 0x0 [0099.773] setsockopt (s=0x4a8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0099.773] closesocket (s=0x4a8) returned 0 [0099.773] CloseHandle (hObject=0x52c) returned 1 [0099.773] setsockopt (s=0x678, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0099.773] closesocket (s=0x678) returned 0 [0099.774] CloseHandle (hObject=0x350) returned 1 [0099.774] UnmapViewOfFile (lpBaseAddress=0x53f0000) returned 1 [0099.775] CloseHandle (hObject=0x424) returned 1 [0099.776] RegCloseKey (hKey=0x420) returned 0x0 [0099.776] CloseHandle (hObject=0x41c) returned 1 [0099.777] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0xfb4 Thread: id = 6 os_tid = 0xe00 Thread: id = 7 os_tid = 0x58c Thread: id = 8 os_tid = 0x908 [0057.232] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0057.232] RoInitialize () returned 0x1 [0057.232] RoUninitialize () returned 0x0 [0057.234] ResetEvent (hEvent=0x35c) returned 1 Thread: id = 9 os_tid = 0xecc Thread: id = 10 os_tid = 0xf10 Thread: id = 11 os_tid = 0xf40 Thread: id = 12 os_tid = 0x73c Thread: id = 13 os_tid = 0xa10 Thread: id = 14 os_tid = 0xf4c Thread: id = 26 os_tid = 0x1204 [0099.778] SleepEx (dwMilliseconds=0x14, bAlertable=0) Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4c27d000" os_pid = "0x5b0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f8bc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 15 os_tid = 0x9bc Thread: id = 16 os_tid = 0x7ec Thread: id = 17 os_tid = 0x770 Thread: id = 18 os_tid = 0x7d8 Thread: id = 19 os_tid = 0x698 Thread: id = 20 os_tid = 0x690 Thread: id = 21 os_tid = 0x5fc Thread: id = 22 os_tid = 0x5f8 Thread: id = 23 os_tid = 0x5f4 Thread: id = 24 os_tid = 0x5b4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2334e000" os_pid = "0xe70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x13d0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && Del /Q /F C:\\Users\\FD1HVy\\Desktop\\xX.exe" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x12e8 [0101.415] GetModuleHandleA (lpModuleName=0x0) returned 0xdf0000 [0101.415] __set_app_type (_Type=0x1) [0101.415] __p__fmode () returned 0x776f3c14 [0101.415] __p__commode () returned 0x776f49ec [0101.415] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe06fd0) returned 0x0 [0101.415] __getmainargs (in: _Argc=0xe1d1a4, _Argv=0xe1d1a8, _Env=0xe1d1ac, _DoWildCard=0, _StartInfo=0xe1d1b8 | out: _Argc=0xe1d1a4, _Argv=0xe1d1a8, _Env=0xe1d1ac) returned 0 [0101.415] _onexit (_Func=0xe08030) returned 0xe08030 [0101.417] _onexit (_Func=0xe08040) returned 0xe08040 [0101.418] _onexit (_Func=0xe08050) returned 0xe08050 [0101.418] _onexit (_Func=0xe08060) returned 0xe08060 [0101.418] _onexit (_Func=0xe08070) returned 0xe08070 [0101.419] _onexit (_Func=0xe08080) returned 0xe08080 [0101.420] GetCurrentThreadId () returned 0x12e8 [0101.420] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x12e8) returned 0xbc [0101.420] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0101.420] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadUILanguage") returned 0x772e4f70 [0101.420] SetThreadUILanguage (LangId=0x0) returned 0x3020409 [0101.424] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0101.424] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2f8fd8c | out: phkResult=0x2f8fd8c*=0x0) returned 0x2 [0101.425] VirtualQuery (in: lpAddress=0x2f8fd97, lpBuffer=0x2f8fd44, dwLength=0x1c | out: lpBuffer=0x2f8fd44*(BaseAddress=0x2f8f000, AllocationBase=0x2e90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0101.425] VirtualQuery (in: lpAddress=0x2e90000, lpBuffer=0x2f8fd44, dwLength=0x1c | out: lpBuffer=0x2f8fd44*(BaseAddress=0x2e90000, AllocationBase=0x2e90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0101.425] VirtualQuery (in: lpAddress=0x2e91000, lpBuffer=0x2f8fd44, dwLength=0x1c | out: lpBuffer=0x2f8fd44*(BaseAddress=0x2e91000, AllocationBase=0x2e90000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0101.425] VirtualQuery (in: lpAddress=0x2e93000, lpBuffer=0x2f8fd44, dwLength=0x1c | out: lpBuffer=0x2f8fd44*(BaseAddress=0x2e93000, AllocationBase=0x2e90000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0101.425] VirtualQuery (in: lpAddress=0x2f90000, lpBuffer=0x2f8fd44, dwLength=0x1c | out: lpBuffer=0x2f8fd44*(BaseAddress=0x2f90000, AllocationBase=0x2f90000, AllocationProtect=0x2, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0101.425] GetConsoleOutputCP () returned 0x1b5 [0101.425] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe23850 | out: lpCPInfo=0xe23850) returned 1 [0101.426] SetConsoleCtrlHandler (HandlerRoutine=0xe17260, Add=1) returned 1 [0101.426] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.426] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xe2388c | out: lpMode=0xe2388c) returned 1 [0101.426] _get_osfhandle (_FileHandle=0) returned 0x8c [0101.426] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xe23888 | out: lpMode=0xe23888) returned 1 [0101.426] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.426] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0101.427] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.427] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xe23890 | out: lpMode=0xe23890) returned 1 [0101.427] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.427] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0101.427] _get_osfhandle (_FileHandle=0) returned 0x8c [0101.427] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xe23894 | out: lpMode=0xe23894) returned 1 [0101.427] _get_osfhandle (_FileHandle=0) returned 0x8c [0101.427] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0101.428] GetEnvironmentStringsW () returned 0x33a4bf0* [0101.428] GetProcessHeap () returned 0x33a0000 [0101.428] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xaca) returned 0x33a56c8 [0101.428] FreeEnvironmentStringsA (penv="A") returned 1 [0101.428] GetProcessHeap () returned 0x33a0000 [0101.428] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x4) returned 0x33a46d0 [0101.428] GetEnvironmentStringsW () returned 0x33a4bf0* [0101.428] GetProcessHeap () returned 0x33a0000 [0101.428] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xaca) returned 0x33a61a0 [0101.428] FreeEnvironmentStringsA (penv="A") returned 1 [0101.428] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f8ece8 | out: phkResult=0x2f8ece8*=0xcc) returned 0x0 [0101.428] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x78, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.428] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x1, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.428] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x1, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.428] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x0, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.428] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x40, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x40, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x40, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.429] RegCloseKey (hKey=0xcc) returned 0x0 [0101.429] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2f8ece8 | out: phkResult=0x2f8ece8*=0xcc) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x40, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x1, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x1, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x0, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x9, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x4, lpData=0x2f8ecf4*=0x9, lpcbData=0x2f8ecec*=0x4) returned 0x0 [0101.429] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2f8ecf0, lpData=0x2f8ecf4, lpcbData=0x2f8ecec*=0x1000 | out: lpType=0x2f8ecf0*=0x0, lpData=0x2f8ecf4*=0x9, lpcbData=0x2f8ecec*=0x1000) returned 0x2 [0101.429] RegCloseKey (hKey=0xcc) returned 0x0 [0101.429] time (in: timer=0x0 | out: timer=0x0) returned 0x5f01a021 [0101.429] srand (_Seed=0x5f01a021) [0101.429] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && Del /Q /F C:\\Users\\FD1HVy\\Desktop\\xX.exe" [0101.429] malloc (_Size=0x4000) returned 0x33521f0 [0101.430] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C timeout 2 && Del /Q /F C:\\Users\\FD1HVy\\Desktop\\xX.exe" [0101.430] malloc (_Size=0xffce) returned 0x35a0048 [0101.430] ??_V@YAXPAX@Z () returned 0x2f8fccc [0101.431] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35a0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.432] malloc (_Size=0xffce) returned 0x35b0020 [0101.432] ??_V@YAXPAX@Z () returned 0x2f8faa0 [0101.432] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0101.432] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0101.433] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0101.433] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0101.433] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0101.433] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0101.433] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0101.433] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0101.433] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0101.433] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0101.433] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0101.433] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0101.433] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0101.433] GetProcessHeap () returned 0x33a0000 [0101.433] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a56c8) returned 1 [0101.433] GetEnvironmentStringsW () returned 0x33a4bf0* [0101.433] GetProcessHeap () returned 0x33a0000 [0101.433] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xae2) returned 0x33a7768 [0101.433] FreeEnvironmentStringsA (penv="A") returned 1 [0101.433] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0101.433] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0101.433] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0101.433] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0101.434] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0101.434] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0101.434] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0101.434] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0101.434] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0101.434] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0101.434] malloc (_Size=0xffce) returned 0x35bfff8 [0101.434] ??_V@YAXPAX@Z () returned 0x2f8f838 [0101.434] GetProcessHeap () returned 0x33a0000 [0101.434] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x38) returned 0x33a0ae0 [0101.434] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35bfff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.435] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x35bfff8, lpFilePart=0x2f8f884 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f8f884*="Desktop") returned 0x17 [0101.435] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0101.435] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2f8f608 | out: lpFindFileData=0x2f8f608*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x33a0b20 [0101.435] FindClose (in: hFindFile=0x33a0b20 | out: hFindFile=0x33a0b20) returned 1 [0101.435] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2f8f608 | out: lpFindFileData=0x2f8f608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x565d4bc5, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x565d4bc5, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x33a0b20 [0101.435] FindClose (in: hFindFile=0x33a0b20 | out: hFindFile=0x33a0b20) returned 1 [0101.436] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2f8f608 | out: lpFindFileData=0x2f8f608*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4b13fa7f, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x4b13fa7f, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x33a0b20 [0101.436] FindClose (in: hFindFile=0x33a0b20 | out: hFindFile=0x33a0b20) returned 1 [0101.436] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0101.436] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0101.436] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0101.436] GetProcessHeap () returned 0x33a0000 [0101.436] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a7768) returned 1 [0101.436] GetEnvironmentStringsW () returned 0x33a4bf0* [0101.436] GetProcessHeap () returned 0x33a0000 [0101.436] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xb1a) returned 0x33a6c78 [0101.436] FreeEnvironmentStringsA (penv="=") returned 1 [0101.436] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35a0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.436] GetProcessHeap () returned 0x33a0000 [0101.436] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a0ae0) returned 1 [0101.436] ??_V@YAXPAX@Z () returned 0x1 [0101.436] ??_V@YAXPAX@Z () returned 0x1 [0101.436] GetProcessHeap () returned 0x33a0000 [0101.436] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x400e) returned 0x33a8d80 [0101.437] GetProcessHeap () returned 0x33a0000 [0101.437] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x78) returned 0x33a77a0 [0101.437] GetProcessHeap () returned 0x33a0000 [0101.437] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a8d80) returned 1 [0101.437] GetConsoleOutputCP () returned 0x1b5 [0101.439] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe23850 | out: lpCPInfo=0xe23850) returned 1 [0101.439] GetUserDefaultLCID () returned 0x409 [0101.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xe1f82c, cchData=8 | out: lpLCData=":") returned 2 [0101.439] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2f8fbf4, cchData=128 | out: lpLCData="0") returned 2 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2f8fbf4, cchData=128 | out: lpLCData="0") returned 2 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2f8fbf4, cchData=128 | out: lpLCData="1") returned 2 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xe1f81c, cchData=8 | out: lpLCData="/") returned 2 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xe1f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xe1f778, cchData=32 | out: lpLCData="Tue") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xe1f738, cchData=32 | out: lpLCData="Wed") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xe1f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xe1f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xe1f678, cchData=32 | out: lpLCData="Sat") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xe1f638, cchData=32 | out: lpLCData="Sun") returned 4 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xe1f80c, cchData=8 | out: lpLCData=".") returned 2 [0101.440] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xe1f7f8, cchData=8 | out: lpLCData=",") returned 2 [0101.440] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0101.442] GetProcessHeap () returned 0x33a0000 [0101.442] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x0, Size=0x20c) returned 0x33a7868 [0101.442] GetConsoleTitleW (in: lpConsoleTitle=0x33a7868, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0101.442] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0101.443] GetProcAddress (hModule=0x772d0000, lpProcName="CopyFileExW") returned 0x772e4330 [0101.443] GetProcAddress (hModule=0x772d0000, lpProcName="IsDebuggerPresent") returned 0x772e5930 [0101.443] GetProcAddress (hModule=0x772d0000, lpProcName="SetConsoleInputExeNameW") returned 0x74d009d0 [0101.443] ??_V@YAXPAX@Z () returned 0x1 [0101.443] GetProcessHeap () returned 0x33a0000 [0101.443] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x400a) returned 0x33a8d80 [0101.444] GetProcessHeap () returned 0x33a0000 [0101.444] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a8d80) returned 1 [0101.444] _wcsicmp (_String1="timeout", _String2=")") returned 75 [0101.444] _wcsicmp (_String1="FOR", _String2="timeout") returned -14 [0101.444] _wcsicmp (_String1="FOR/?", _String2="timeout") returned -14 [0101.444] _wcsicmp (_String1="IF", _String2="timeout") returned -11 [0101.444] _wcsicmp (_String1="IF/?", _String2="timeout") returned -11 [0101.444] _wcsicmp (_String1="REM", _String2="timeout") returned -2 [0101.444] _wcsicmp (_String1="REM/?", _String2="timeout") returned -2 [0101.444] GetProcessHeap () returned 0x33a0000 [0101.444] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x58) returned 0x33a7a80 [0101.444] GetProcessHeap () returned 0x33a0000 [0101.444] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x18) returned 0x33a7ae0 [0101.444] GetProcessHeap () returned 0x33a0000 [0101.444] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x10) returned 0x33a7b00 [0101.445] GetProcessHeap () returned 0x33a0000 [0101.445] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x58) returned 0x33a7b18 [0101.445] _wcsicmp (_String1="FOR", _String2="Del") returned 2 [0101.445] _wcsicmp (_String1="FOR/?", _String2="Del") returned 2 [0101.445] _wcsicmp (_String1="IF", _String2="Del") returned 5 [0101.445] _wcsicmp (_String1="IF/?", _String2="Del") returned 5 [0101.445] _wcsicmp (_String1="REM", _String2="Del") returned 14 [0101.445] _wcsicmp (_String1="REM/?", _String2="Del") returned 14 [0101.445] GetProcessHeap () returned 0x33a0000 [0101.445] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x58) returned 0x33a7b78 [0101.445] GetProcessHeap () returned 0x33a0000 [0101.445] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x10) returned 0x33a7bd8 [0101.446] GetProcessHeap () returned 0x33a0000 [0101.446] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x54) returned 0x33a7bf0 [0101.447] GetConsoleTitleW (in: lpConsoleTitle=0x2f8fa88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0101.447] malloc (_Size=0xffce) returned 0x35b2650 [0101.447] ??_V@YAXPAX@Z () returned 0x2f8f814 [0101.448] malloc (_Size=0xffce) returned 0x35c2628 [0101.448] ??_V@YAXPAX@Z () returned 0x2f8f5cc [0101.449] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0101.449] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0101.449] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0101.449] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0101.449] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0101.449] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0101.449] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0101.449] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0101.449] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0101.449] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0101.449] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0101.449] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0101.449] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0101.449] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0101.449] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0101.449] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0101.449] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0101.449] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0101.449] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0101.449] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0101.449] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0101.449] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0101.450] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0101.450] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0101.450] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0101.450] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0101.450] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0101.450] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0101.450] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0101.450] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0101.450] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0101.450] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0101.450] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0101.450] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0101.450] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0101.450] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0101.450] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0101.450] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0101.450] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0101.450] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0101.450] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0101.450] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0101.450] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0101.450] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0101.450] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0101.450] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0101.450] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0101.450] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0101.450] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0101.450] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0101.450] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0101.450] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0101.451] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0101.451] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0101.451] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0101.451] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0101.451] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0101.451] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0101.451] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0101.451] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0101.451] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0101.451] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0101.451] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0101.451] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0101.451] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0101.451] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0101.451] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0101.451] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0101.451] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0101.451] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0101.451] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0101.451] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0101.451] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0101.451] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0101.451] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0101.451] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0101.451] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0101.451] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0101.451] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0101.451] _wcsicmp (_String1="timeout", _String2="FOR") returned 14 [0101.451] _wcsicmp (_String1="timeout", _String2="IF") returned 11 [0101.451] _wcsicmp (_String1="timeout", _String2="REM") returned 2 [0101.452] ??_V@YAXPAX@Z () returned 0x1 [0101.452] GetProcessHeap () returned 0x33a0000 [0101.452] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xffd6) returned 0x33a8d80 [0101.452] GetProcessHeap () returned 0x33a0000 [0101.452] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x20) returned 0x33a7c50 [0101.452] _wcsnicmp (_String1="time", _String2="cmd ", _MaxCount=0x4) returned 17 [0101.453] malloc (_Size=0xffce) returned 0x35c2628 [0101.453] ??_V@YAXPAX@Z () returned 0x2f8f34c [0101.453] GetProcessHeap () returned 0x33a0000 [0101.453] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x1ffa4) returned 0x33b8d60 [0101.455] SetErrorMode (uMode=0x0) returned 0x0 [0101.455] SetErrorMode (uMode=0x1) returned 0x0 [0101.455] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x33b8d68, lpFilePart=0x2f8f36c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2f8f36c*="Desktop") returned 0x17 [0101.455] SetErrorMode (uMode=0x0) returned 0x1 [0101.455] GetProcessHeap () returned 0x33a0000 [0101.455] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33b8d60, Size=0x48) returned 0x33b8d60 [0101.455] GetProcessHeap () returned 0x33a0000 [0101.455] RtlSizeHeap (HeapHandle=0x33a0000, Flags=0x0, MemoryPointer=0x33b8d60) returned 0x48 [0101.455] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0101.455] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0101.456] GetProcessHeap () returned 0x33a0000 [0101.456] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x1b4) returned 0x33a7c78 [0101.456] GetProcessHeap () returned 0x33a0000 [0101.456] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x360) returned 0x33a7e38 [0101.464] GetProcessHeap () returned 0x33a0000 [0101.464] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33a7e38, Size=0x1b6) returned 0x33a7e38 [0101.464] GetProcessHeap () returned 0x33a0000 [0101.464] RtlSizeHeap (HeapHandle=0x33a0000, Flags=0x0, MemoryPointer=0x33a7e38) returned 0x1b6 [0101.464] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xe1f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0101.464] GetProcessHeap () returned 0x33a0000 [0101.464] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xe0) returned 0x33a7ff8 [0101.465] GetProcessHeap () returned 0x33a0000 [0101.465] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33a7ff8, Size=0x76) returned 0x33a7ff8 [0101.465] GetProcessHeap () returned 0x33a0000 [0101.465] RtlSizeHeap (HeapHandle=0x33a0000, Flags=0x0, MemoryPointer=0x33a7ff8) returned 0x76 [0101.466] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0101.466] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x2f8f0f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f8f0f8) returned 0xffffffff [0101.466] GetLastError () returned 0x2 [0101.466] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0101.466] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x2f8f0f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f8f0f8) returned 0xffffffff [0101.468] GetLastError () returned 0x2 [0101.468] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0101.469] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x2f8f0f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f8f0f8) returned 0x33a8078 [0101.469] GetProcessHeap () returned 0x33a0000 [0101.469] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x0, Size=0x14) returned 0x33a80b8 [0101.469] FindClose (in: hFindFile=0x33a8078 | out: hFindFile=0x33a8078) returned 1 [0101.469] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\timeout.COM", fInfoLevelId=0x1, lpFindFileData=0x2f8f0f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f8f0f8) returned 0xffffffff [0101.469] GetLastError () returned 0x2 [0101.469] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\timeout.EXE", fInfoLevelId=0x1, lpFindFileData=0x2f8f0f8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2f8f0f8) returned 0x33a8078 [0101.469] GetProcessHeap () returned 0x33a0000 [0101.469] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33a80b8, Size=0x4) returned 0x33a80b8 [0101.469] FindClose (in: hFindFile=0x33a8078 | out: hFindFile=0x33a8078) returned 1 [0101.469] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0101.469] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0101.469] ??_V@YAXPAX@Z () returned 0x1 [0101.469] GetConsoleTitleW (in: lpConsoleTitle=0x2f8f5fc, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0101.481] InitializeProcThreadAttributeList (in: lpAttributeList=0x2f8f528, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2f8f514 | out: lpAttributeList=0x2f8f528, lpSize=0x2f8f514) returned 1 [0101.481] UpdateProcThreadAttribute (in: lpAttributeList=0x2f8f528, dwFlags=0x0, Attribute=0x60001, lpValue=0x2f8f510, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2f8f528, lpPreviousValue=0x0) returned 1 [0101.481] GetStartupInfoW (in: lpStartupInfo=0x2f8f560 | out: lpStartupInfo=0x2f8f560*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0101.481] GetProcessHeap () returned 0x33a0000 [0101.481] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x18) returned 0x33a8078 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0101.481] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0101.482] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0101.482] GetProcessHeap () returned 0x33a0000 [0101.482] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a8078) returned 1 [0101.482] GetProcessHeap () returned 0x33a0000 [0101.482] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xa) returned 0x33a8078 [0101.482] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0101.488] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.488] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0101.497] _get_osfhandle (_FileHandle=0) returned 0x8c [0101.497] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0101.512] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\timeout.exe", lpCommandLine="timeout 2 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x2f8f4b0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="timeout 2 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2f8f4fc | out: lpCommandLine="timeout 2 ", lpProcessInformation=0x2f8f4fc*(hProcess=0xe0, hThread=0xdc, dwProcessId=0x11dc, dwThreadId=0x13a4)) returned 1 [0101.614] CloseHandle (hObject=0xdc) returned 1 [0101.614] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0101.614] GetProcessHeap () returned 0x33a0000 [0101.614] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a6c78) returned 1 [0101.614] GetEnvironmentStringsW () returned 0x33a6c78* [0101.614] GetProcessHeap () returned 0x33a0000 [0101.614] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xb1a) returned 0x33bacd0 [0101.614] FreeEnvironmentStringsA (penv="=") returned 1 [0101.614] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0104.128] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x2f8f494 | out: lpExitCode=0x2f8f494*=0x0) returned 1 [0104.128] CloseHandle (hObject=0xe0) returned 1 [0104.129] _vsnwprintf (in: _Buffer=0x2f8f57c, _BufferCount=0x13, _Format="%08X", _ArgList=0x2f8f49c | out: _Buffer="00000000") returned 8 [0104.129] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0104.129] GetProcessHeap () returned 0x33a0000 [0104.129] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33bacd0) returned 1 [0104.129] GetEnvironmentStringsW () returned 0x33a81f8* [0104.129] GetProcessHeap () returned 0x33a0000 [0104.129] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xb40) returned 0x33bc340 [0104.129] FreeEnvironmentStringsA (penv="=") returned 1 [0104.129] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0104.129] GetProcessHeap () returned 0x33a0000 [0104.129] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33bc340) returned 1 [0104.129] GetEnvironmentStringsW () returned 0x33a81f8* [0104.129] GetProcessHeap () returned 0x33a0000 [0104.129] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xb40) returned 0x33bc340 [0104.129] FreeEnvironmentStringsA (penv="=") returned 1 [0104.129] GetProcessHeap () returned 0x33a0000 [0104.129] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a8078) returned 1 [0104.129] DeleteProcThreadAttributeList (in: lpAttributeList=0x2f8f528 | out: lpAttributeList=0x2f8f528) [0104.129] ??_V@YAXPAX@Z () returned 0x1 [0104.129] GetConsoleTitleW (in: lpConsoleTitle=0x2f8fa88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0104.168] malloc (_Size=0xffce) returned 0x35b2650 [0104.168] ??_V@YAXPAX@Z () returned 0x2f8f814 [0104.168] malloc (_Size=0xffce) returned 0x35c2628 [0104.168] ??_V@YAXPAX@Z () returned 0x2f8f5cc [0104.168] _wcsicmp (_String1="Del", _String2="DIR") returned -4 [0104.168] _wcsicmp (_String1="Del", _String2="ERASE") returned -1 [0104.168] _wcsicmp (_String1="Del", _String2="DEL") returned 0 [0104.168] ??_V@YAXPAX@Z () returned 0x1 [0104.168] GetProcessHeap () returned 0x33a0000 [0104.168] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xa0) returned 0x33a5c00 [0104.168] GetProcessHeap () returned 0x33a0000 [0104.168] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33a5c00, Size=0x58) returned 0x33a5c00 [0104.168] GetProcessHeap () returned 0x33a0000 [0104.168] RtlSizeHeap (HeapHandle=0x33a0000, Flags=0x0, MemoryPointer=0x33a5c00) returned 0x58 [0104.168] GetProcessHeap () returned 0x33a0000 [0104.168] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x5c) returned 0x33a5c60 [0104.168] malloc (_Size=0xffce) returned 0x35c2628 [0104.168] ??_V@YAXPAX@Z () returned 0x2f8f55c [0104.168] GetProcessHeap () returned 0x33a0000 [0104.168] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xa0) returned 0x33a5cc8 [0104.169] GetProcessHeap () returned 0x33a0000 [0104.169] RtlReAllocateHeap (Heap=0x33a0000, Flags=0x0, Ptr=0x33a5cc8, Size=0x58) returned 0x33a5cc8 [0104.169] GetProcessHeap () returned 0x33a0000 [0104.169] RtlSizeHeap (HeapHandle=0x33a0000, Flags=0x0, MemoryPointer=0x33a5cc8) returned 0x58 [0104.169] GetProcessHeap () returned 0x33a0000 [0104.169] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x46) returned 0x33a5d28 [0104.169] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35c2628 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0104.169] malloc (_Size=0xffd2) returned 0x35d2600 [0104.169] ??_V@YAXPAX@Z () returned 0x2f8f314 [0104.170] malloc (_Size=0xffd2) returned 0x35e25e0 [0104.170] ??_V@YAXPAX@Z () returned 0x2f8ee9c [0104.170] malloc (_Size=0xffd2) returned 0x35f25c0 [0104.171] ??_V@YAXPAX@Z () returned 0x2f8ee9c [0104.171] GetProcessHeap () returned 0x33a0000 [0104.171] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x38) returned 0x33a5d78 [0104.171] malloc (_Size=0xffce) returned 0x36025a0 [0104.171] ??_V@YAXPAX@Z () returned 0x2f8e834 [0104.172] malloc (_Size=0xffce) returned 0x3612578 [0104.172] ??_V@YAXPAX@Z () returned 0x2f8e834 [0104.172] malloc (_Size=0xffce) returned 0x3622550 [0104.173] ??_V@YAXPAX@Z () returned 0x2f8e5e4 [0104.173] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x3622550 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0104.173] ??_V@YAXPAX@Z () returned 0x1 [0104.173] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x2f8e874, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x36025a0, nFileSystemNameSize=0x7fe7 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x2f8e874*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0104.175] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0104.175] ??_V@YAXPAX@Z () returned 0x2f8e84c [0104.175] ??_V@YAXPAX@Z () returned 0x1 [0104.176] ??_V@YAXPAX@Z () returned 0x1 [0104.177] malloc (_Size=0xffce) returned 0x36025a0 [0104.177] ??_V@YAXPAX@Z () returned 0x2f8ec5c [0104.178] GetProcessHeap () returned 0x33a0000 [0104.178] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x2c) returned 0x33a5db8 [0104.178] GetProcessHeap () returned 0x33a0000 [0104.178] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x258) returned 0x33a5ea0 [0104.178] _wcsicmp (_String1="xX.exe", _String2=".") returned 74 [0104.178] _wcsicmp (_String1="xX.exe", _String2="..") returned 74 [0104.178] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe")) returned 0x20 [0104.178] GetProcessHeap () returned 0x33a0000 [0104.178] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0xffd6) returned 0x33bce88 [0104.178] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x33bce90 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0104.178] SetErrorMode (uMode=0x0) returned 0x0 [0104.178] SetErrorMode (uMode=0x1) returned 0x0 [0104.178] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", nBufferLength=0x7fe7, lpBuffer=0x36025a0, lpFilePart=0x2f8ec7c | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\xX.exe", lpFilePart=0x2f8ec7c*="xX.exe") returned 0x1e [0104.178] SetErrorMode (uMode=0x0) returned 0x1 [0104.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0104.179] GetProcessHeap () returned 0x33a0000 [0104.179] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x258) returned 0x33a0ae0 [0104.179] _wcsicmp (_String1="xX.exe", _String2=".") returned 74 [0104.179] _wcsicmp (_String1="xX.exe", _String2="..") returned 74 [0104.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\xx.exe")) returned 0x20 [0104.179] ??_V@YAXPAX@Z () returned 0x1 [0104.179] GetProcessHeap () returned 0x33a0000 [0104.179] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x16) returned 0x33a5df0 [0104.179] GetProcessHeap () returned 0x33a0000 [0104.179] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x38) returned 0x33a6100 [0104.179] GetProcessHeap () returned 0x33a0000 [0104.179] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x38) returned 0x33a6140 [0104.179] ??_V@YAXPAX@Z () returned 0x1 [0104.180] ??_V@YAXPAX@Z () returned 0x1 [0104.182] malloc (_Size=0xffd2) returned 0x35e25e0 [0104.182] ??_V@YAXPAX@Z () returned 0x2f8efd4 [0104.183] GetProcessHeap () returned 0x33a0000 [0104.183] RtlAllocateHeap (HeapHandle=0x33a0000, Flags=0x8, Size=0x808) returned 0x33a0d40 [0104.183] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xX.exe", fInfoLevelId=0x0, lpFindFileData=0x33a0d4c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33a0d4c) returned 0x33a1550 [0104.183] malloc (_Size=0xffd2) returned 0x35f25c0 [0104.183] ??_V@YAXPAX@Z () returned 0x2f8eb64 [0104.184] malloc (_Size=0xffd2) returned 0x36025a0 [0104.184] ??_V@YAXPAX@Z () returned 0x2f8eb64 [0104.184] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0104.184] NtOpenFile (in: FileHandle=0x2f8eb8c, DesiredAccess=0x10000, ObjectAttributes=0x2f8eb54*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\FD1HVy\\Desktop\\xX.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x2f8eb7c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x2f8eb8c*=0xdc, IoStatusBlock=0x2f8eb7c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0104.185] RtlReleaseRelativeName () returned 0x2f8eb6c [0104.185] RtlFreeAnsiString (AnsiString="\\") [0104.185] NtQueryVolumeInformationFile (in: FileHandle=0xdc, IoStatusBlock=0x2f8eab8, FsInformation=0x2f8eac0, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x2f8eab8, FsInformation=0x2f8eac0) returned 0x0 [0104.185] CloseHandle (hObject=0xdc) returned 1 [0104.185] ??_V@YAXPAX@Z () returned 0x1 [0104.185] ??_V@YAXPAX@Z () returned 0x1 [0104.186] FindNextFileW (in: hFindFile=0x33a1550, lpFindFileData=0x33a0d4c | out: lpFindFileData=0x33a0d4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20155900, ftCreationTime.dwHighDateTime=0x1d652b0, ftLastAccessTime.dwLowDateTime=0x20155900, ftLastAccessTime.dwHighDateTime=0x1d652b0, ftLastWriteTime.dwLowDateTime=0x1ee42c00, ftLastWriteTime.dwHighDateTime=0x1d652b0, nFileSizeHigh=0x0, nFileSizeLow=0x31400, dwReserved0=0x0, dwReserved1=0x0, cFileName="xX.exe", cAlternateFileName="")) returned 0 [0104.187] GetLastError () returned 0x12 [0104.187] FindClose (in: hFindFile=0x33a1550 | out: hFindFile=0x33a1550) returned 1 [0104.187] ??_V@YAXPAX@Z () returned 0x1 [0104.189] GetProcessHeap () returned 0x33a0000 [0104.189] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a0d40) returned 1 [0104.189] GetProcessHeap () returned 0x33a0000 [0104.189] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a6140) returned 1 [0104.189] GetProcessHeap () returned 0x33a0000 [0104.189] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5df0) returned 1 [0104.189] GetProcessHeap () returned 0x33a0000 [0104.189] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a6100) returned 1 [0104.189] ??_V@YAXPAX@Z () returned 0x1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a0ae0) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33bce88) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5ea0) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5db8) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5d78) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5d28) returned 1 [0104.191] GetProcessHeap () returned 0x33a0000 [0104.191] RtlFreeHeap (HeapHandle=0x33a0000, Flags=0x0, BaseAddress=0x33a5cc8) returned 1 [0104.191] ??_V@YAXPAX@Z () returned 0x1 [0104.192] ??_V@YAXPAX@Z () returned 0x1 [0104.194] _get_osfhandle (_FileHandle=1) returned 0x90 [0104.194] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0104.203] _get_osfhandle (_FileHandle=1) returned 0x90 [0104.203] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xe23890 | out: lpMode=0xe23890) returned 1 [0104.211] _get_osfhandle (_FileHandle=1) returned 0x90 [0104.212] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0104.292] _get_osfhandle (_FileHandle=0) returned 0x8c [0104.292] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xe23894 | out: lpMode=0xe23894) returned 1 [0104.416] _get_osfhandle (_FileHandle=0) returned 0x8c [0104.416] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0104.511] SetConsoleInputExeNameW () returned 0x1 [0104.511] GetConsoleOutputCP () returned 0x1b5 [0104.623] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xe23850 | out: lpCPInfo=0xe23850) returned 1 [0104.623] SetThreadUILanguage (LangId=0x0) returned 0x3020409 [0104.714] exit (_Code=0) [0104.714] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 32 os_tid = 0x1328 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x10e09000" os_pid = "0x1208" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe70" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x1008 Thread: id = 28 os_tid = 0xf00 Thread: id = 29 os_tid = 0x348 Thread: id = 30 os_tid = 0x1334 Thread: id = 31 os_tid = 0x135c Process: id = "5" image_name = "timeout.exe" filename = "c:\\windows\\syswow64\\timeout.exe" page_root = "0x22947000" os_pid = "0x11dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe70" cmd_line = "timeout 2 " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0x13a4 [0101.789] GetModuleHandleA (lpModuleName=0x0) returned 0xa60000 [0101.789] __set_app_type (_Type=0x1) [0101.789] __p__fmode () returned 0x776f3c14 [0101.789] __p__commode () returned 0x776f49ec [0101.789] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa64e70) returned 0x0 [0101.789] __wgetmainargs (in: _Argc=0xa66018, _Argv=0xa6601c, _Env=0xa66020, _DoWildCard=0, _StartInfo=0xa6602c | out: _Argc=0xa66018, _Argv=0xa6601c, _Env=0xa66020) returned 0 [0101.790] SetThreadUILanguage (LangId=0x0) returned 0x4b0409 [0101.796] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0101.796] SetLastError (dwErrCode=0x0) [0101.796] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0101.796] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0101.796] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0101.796] RtlVerifyVersionInfo (VersionInfo=0x69f130, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e800 [0101.796] lstrlenW (lpString="") returned 0 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x2) returned 0x15d300 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1617e0 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e998 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161760 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161780 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1615c0 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161480 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e8a8 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1614e0 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161540 [0101.796] GetProcessHeap () returned 0x150000 [0101.796] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161440 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1614c0 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e980 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161600 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1615e0 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1617a0 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1617c0 [0101.797] SetThreadUILanguage (LangId=0x0) returned 0x4b0409 [0101.797] SetLastError (dwErrCode=0x0) [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161580 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161740 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161640 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161500 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1616e0 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e968 [0101.797] _memicmp (_Buf1=0x15e968, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.797] GetProcessHeap () returned 0x150000 [0101.797] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x208) returned 0x161800 [0101.797] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x161800, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f [0101.798] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\WINDOWS\\SysWOW64\\timeout.exe", lpdwHandle=0x69f23c | out: lpdwHandle=0x69f23c) returned 0x75c [0101.798] GetProcessHeap () returned 0x150000 [0101.798] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x766) returned 0x161a10 [0101.798] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\WINDOWS\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x766, lpData=0x161a10 | out: lpData=0x161a10) returned 1 [0101.798] VerQueryValueW (in: pBlock=0x161a10, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x69f244, puLen=0x69f248 | out: lplpBuffer=0x69f244*=0x161db8, puLen=0x69f248) returned 1 [0101.799] _memicmp (_Buf1=0x15e968, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.799] _vsnwprintf (in: _Buffer=0x161800, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x69f228 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0101.799] VerQueryValueW (in: pBlock=0x161a10, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x69f254, puLen=0x69f250 | out: lplpBuffer=0x69f254*=0x161bec, puLen=0x69f250) returned 1 [0101.799] lstrlenW (lpString="timeout.exe") returned 11 [0101.799] lstrlenW (lpString="timeout.exe") returned 11 [0101.799] lstrlenW (lpString=".EXE") returned 4 [0101.799] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0101.800] lstrlenW (lpString="timeout.exe") returned 11 [0101.800] lstrlenW (lpString=".EXE") returned 4 [0101.800] _memicmp (_Buf1=0x15e968, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.800] lstrlenW (lpString="timeout") returned 7 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161420 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161620 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161460 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1614a0 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e920 [0101.800] _memicmp (_Buf1=0x15e920, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0xa0) returned 0x1546b8 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161520 [0101.800] GetProcessHeap () returned 0x150000 [0101.800] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161560 [0101.800] GetProcessHeap () returned 0x150000 [0101.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x1615a0 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15e770 [0101.801] _memicmp (_Buf1=0x15e770, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x200) returned 0x1622b0 [0101.801] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1622b0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0101.801] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x30) returned 0x158880 [0101.801] _vsnwprintf (in: _Buffer=0x1546b8, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x69f22c | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161a10) returned 1 [0101.801] GetProcessHeap () returned 0x150000 [0101.801] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161a10) returned 0x766 [0101.801] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161a10 | out: hHeap=0x150000) returned 1 [0101.801] SetLastError (dwErrCode=0x0) [0101.801] GetThreadLocale () returned 0x409 [0101.801] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0101.801] lstrlenW (lpString="?") returned 1 [0101.801] GetThreadLocale () returned 0x409 [0101.801] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0101.801] GetThreadLocale () returned 0x409 [0101.801] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0101.801] lstrlenW (lpString="nobreak") returned 7 [0101.801] SetLastError (dwErrCode=0x0) [0101.801] SetLastError (dwErrCode=0x0) [0101.801] lstrlenW (lpString="2") returned 1 [0101.801] SetLastError (dwErrCode=0x490) [0101.801] SetLastError (dwErrCode=0x0) [0101.801] lstrlenW (lpString="2") returned 1 [0101.802] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0101.802] SetLastError (dwErrCode=0x490) [0101.802] SetLastError (dwErrCode=0x0) [0101.802] GetProcessHeap () returned 0x150000 [0101.802] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x10) returned 0x15ea28 [0101.802] _memicmp (_Buf1=0x15ea28, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.802] lstrlenW (lpString="2") returned 1 [0101.802] GetProcessHeap () returned 0x150000 [0101.802] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x4) returned 0x15d250 [0101.802] lstrlenW (lpString="2") returned 1 [0101.802] lstrlenW (lpString=" \x09") returned 2 [0101.802] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0101.802] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0101.802] GetLastError () returned 0x0 [0101.802] lstrlenW (lpString="2") returned 1 [0101.802] lstrlenW (lpString="2") returned 1 [0101.802] SetLastError (dwErrCode=0x0) [0101.802] _errno () returned 0x3fe05b0 [0101.802] wcstol (in: _String="2", _EndPtr=0x69f414, _Radix=10 | out: _EndPtr=0x69f414*="") returned 2 [0101.802] lstrlenW (lpString="") returned 0 [0101.802] _errno () returned 0x3fe05b0 [0101.802] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0101.802] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0101.802] GetFileType (hFile=0x8c) returned 0x2 [0101.802] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x69f408 | out: lpMode=0x69f408) returned 1 [0101.803] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0101.803] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x69f428 | out: lpMode=0x69f428) returned 1 [0101.803] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e1) returned 1 [0101.803] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x8c, lpNumberOfEvents=0x69f430 | out: lpNumberOfEvents=0x69f430) returned 1 [0101.804] FlushConsoleInputBuffer (hConsoleInput=0x8c) returned 1 [0101.804] GetProcessHeap () returned 0x150000 [0101.804] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161720 [0101.804] _memicmp (_Buf1=0x15e770, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.804] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x1622b0, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0101.804] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0101.804] GetProcessHeap () returned 0x150000 [0101.804] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x24) returned 0x153c98 [0101.804] _vsnwprintf (in: _Buffer=0x69f67c, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0x69f3f4 | out: _Buffer="\nWaiting for 2") returned 14 [0101.804] __iob_func () returned 0x776f2608 [0101.804] _fileno (_File=0x776f2628) returned 1 [0101.804] _errno () returned 0x3fe05b0 [0101.804] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.804] _errno () returned 0x3fe05b0 [0101.804] GetFileType (hFile=0x90) returned 0x2 [0101.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0101.804] GetFileType (hFile=0x90) returned 0x2 [0101.805] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x69f3cc | out: lpMode=0x69f3cc) returned 1 [0101.805] __iob_func () returned 0x776f2608 [0101.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0101.805] lstrlenW (lpString="\nWaiting for 2") returned 14 [0101.805] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0x69f67c*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0x69f3f0, lpReserved=0x0 | out: lpBuffer=0x69f67c*, lpNumberOfCharsWritten=0x69f3f0*=0xe) returned 1 [0101.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0101.806] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x90, lpConsoleScreenBufferInfo=0x69f440 | out: lpConsoleScreenBufferInfo=0x69f440) returned 1 [0101.806] GetProcessHeap () returned 0x150000 [0101.806] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x14) returned 0x161660 [0101.806] _memicmp (_Buf1=0x15e770, _Buf2=0xa61144, _Size=0x7) returned 0 [0101.806] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x1622b0, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0101.806] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0101.806] GetProcessHeap () returned 0x150000 [0101.806] RtlAllocateHeap (HeapHandle=0x150000, Flags=0xc, Size=0x4c) returned 0x159e80 [0101.806] __iob_func () returned 0x776f2608 [0101.806] _fileno (_File=0x776f2628) returned 1 [0101.806] _errno () returned 0x3fe05b0 [0101.806] _get_osfhandle (_FileHandle=1) returned 0x90 [0101.806] _errno () returned 0x3fe05b0 [0101.806] GetFileType (hFile=0x90) returned 0x2 [0101.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0101.806] GetFileType (hFile=0x90) returned 0x2 [0101.807] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x69f3cc | out: lpMode=0x69f3cc) returned 1 [0101.807] __iob_func () returned 0x776f2608 [0101.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0101.807] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0101.807] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0x159e80*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x69f3f0, lpReserved=0x0 | out: lpBuffer=0x159e80*, lpNumberOfCharsWritten=0x69f3f0*=0x25) returned 1 [0101.807] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0101.807] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0101.807] Sleep (dwMilliseconds=0x64) [0101.914] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0101.920] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0101.920] Sleep (dwMilliseconds=0x64) [0102.089] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.092] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0102.092] Sleep (dwMilliseconds=0x64) [0102.216] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.218] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0102.219] Sleep (dwMilliseconds=0x64) [0102.354] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.361] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0102.361] Sleep (dwMilliseconds=0x64) [0102.502] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.516] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0102.516] Sleep (dwMilliseconds=0x64) [0102.653] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.663] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a022 [0102.663] Sleep (dwMilliseconds=0x64) [0102.769] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0102.902] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0102.902] _vsnwprintf (in: _Buffer=0x69f67c, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x69f3f0 | out: _Buffer="\x081") returned 2 [0102.902] SetConsoleCursorPosition (hConsoleOutput=0x90, dwCursorPosition=0x1000d) returned 1 [0102.926] __iob_func () returned 0x776f2608 [0102.926] _fileno (_File=0x776f2628) returned 1 [0102.926] _errno () returned 0x3fe05b0 [0102.926] _get_osfhandle (_FileHandle=1) returned 0x90 [0102.926] _errno () returned 0x3fe05b0 [0102.926] GetFileType (hFile=0x90) returned 0x2 [0102.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0102.926] GetFileType (hFile=0x90) returned 0x2 [0102.926] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x69f3cc | out: lpMode=0x69f3cc) returned 1 [0102.932] __iob_func () returned 0x776f2608 [0102.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0102.934] lstrlenW (lpString="\x081") returned 2 [0102.934] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0x69f67c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x69f3f0, lpReserved=0x0 | out: lpBuffer=0x69f67c*, lpNumberOfCharsWritten=0x69f3f0*=0x2) returned 1 [0102.942] Sleep (dwMilliseconds=0x64) [0103.053] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.073] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.073] Sleep (dwMilliseconds=0x64) [0103.176] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.183] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.183] Sleep (dwMilliseconds=0x64) [0103.290] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.300] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.300] Sleep (dwMilliseconds=0x64) [0103.412] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.418] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.420] Sleep (dwMilliseconds=0x64) [0103.550] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.625] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.625] Sleep (dwMilliseconds=0x64) [0103.732] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.738] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a023 [0103.740] Sleep (dwMilliseconds=0x64) [0103.857] PeekConsoleInputW (in: hConsoleInput=0x8c, lpBuffer=0x69f458, nLength=0x2, lpNumberOfEventsRead=0x69f430 | out: lpBuffer=0x69f458, lpNumberOfEventsRead=0x69f430) returned 1 [0103.861] time (in: timer=0x69f438 | out: timer=0x69f438) returned 0x5f01a024 [0103.863] _vsnwprintf (in: _Buffer=0x69f67c, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x69f3f0 | out: _Buffer="\x080") returned 2 [0103.863] SetConsoleCursorPosition (hConsoleOutput=0x90, dwCursorPosition=0x1000d) returned 1 [0103.957] __iob_func () returned 0x776f2608 [0103.957] _fileno (_File=0x776f2628) returned 1 [0103.957] _errno () returned 0x3fe05b0 [0103.957] _get_osfhandle (_FileHandle=1) returned 0x90 [0103.957] _errno () returned 0x3fe05b0 [0103.957] GetFileType (hFile=0x90) returned 0x2 [0103.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0103.957] GetFileType (hFile=0x90) returned 0x2 [0103.957] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x69f3cc | out: lpMode=0x69f3cc) returned 1 [0103.965] __iob_func () returned 0x776f2608 [0103.965] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0103.965] lstrlenW (lpString="\x080") returned 2 [0103.965] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0x69f67c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x69f3f0, lpReserved=0x0 | out: lpBuffer=0x69f67c*, lpNumberOfCharsWritten=0x69f3f0*=0x2) returned 1 [0103.974] Sleep (dwMilliseconds=0x64) [0104.092] __iob_func () returned 0x776f2608 [0104.092] _fileno (_File=0x776f2628) returned 1 [0104.092] _errno () returned 0x3fe05b0 [0104.092] _get_osfhandle (_FileHandle=1) returned 0x90 [0104.092] _errno () returned 0x3fe05b0 [0104.092] GetFileType (hFile=0x90) returned 0x2 [0104.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0104.092] GetFileType (hFile=0x90) returned 0x2 [0104.092] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x69f3cc | out: lpMode=0x69f3cc) returned 1 [0104.094] __iob_func () returned 0x776f2608 [0104.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0104.094] lstrlenW (lpString="\n") returned 1 [0104.094] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0xa61104*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x69f3f0, lpReserved=0x0 | out: lpBuffer=0xa61104*, lpNumberOfCharsWritten=0x69f3f0*=0x1) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1546b8) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1546b8) returned 0xa0 [0104.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1546b8 | out: hHeap=0x150000) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e920) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e920) returned 0x10 [0104.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e920 | out: hHeap=0x150000) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1614a0) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1614a0) returned 0x14 [0104.096] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1614a0 | out: hHeap=0x150000) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15d250) returned 1 [0104.096] GetProcessHeap () returned 0x150000 [0104.096] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15d250) returned 0x4 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15d250 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15ea28) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15ea28) returned 0x10 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15ea28 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161460) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161460) returned 0x14 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161460 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161800) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161800) returned 0x208 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161800 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e968) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e968) returned 0x10 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e968 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1616e0) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1616e0) returned 0x14 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1616e0 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1622b0) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1622b0) returned 0x200 [0104.097] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1622b0 | out: hHeap=0x150000) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] GetProcessHeap () returned 0x150000 [0104.097] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e770) returned 1 [0104.097] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e770) returned 0x10 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e770 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161740) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161740) returned 0x14 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161740 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15d300) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15d300) returned 0x2 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15d300 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1617e0) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1617e0) returned 0x14 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1617e0 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161760) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161760) returned 0x14 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161760 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161780) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161780) returned 0x14 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161780 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1615c0) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1615c0) returned 0x14 [0104.098] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1615c0 | out: hHeap=0x150000) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161520) returned 1 [0104.098] GetProcessHeap () returned 0x150000 [0104.098] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161520) returned 0x14 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161520 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161560) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161560) returned 0x14 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161560 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x158880) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x158880) returned 0x30 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x158880 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1615a0) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1615a0) returned 0x14 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1615a0 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x153c98) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x153c98) returned 0x24 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x153c98 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161720) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161720) returned 0x14 [0104.099] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161720 | out: hHeap=0x150000) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x159e80) returned 1 [0104.099] GetProcessHeap () returned 0x150000 [0104.099] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x159e80) returned 0x4c [0104.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x159e80 | out: hHeap=0x150000) returned 1 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161660) returned 1 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161660) returned 0x14 [0104.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161660 | out: hHeap=0x150000) returned 1 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e998) returned 1 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e998) returned 0x10 [0104.101] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e998 | out: hHeap=0x150000) returned 1 [0104.101] GetProcessHeap () returned 0x150000 [0104.101] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161480) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161480) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161480 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1614e0) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1614e0) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1614e0 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161540) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161540) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161540 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161440) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161440) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161440 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e8a8) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e8a8) returned 0x10 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e8a8 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1614c0) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1614c0) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1614c0 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161600) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.102] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161600) returned 0x14 [0104.102] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161600 | out: hHeap=0x150000) returned 1 [0104.102] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1615e0) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1615e0) returned 0x14 [0104.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1615e0 | out: hHeap=0x150000) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1617a0) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1617a0) returned 0x14 [0104.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1617a0 | out: hHeap=0x150000) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161580) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161580) returned 0x14 [0104.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161580 | out: hHeap=0x150000) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161640) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161640) returned 0x14 [0104.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161640 | out: hHeap=0x150000) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161500) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161500) returned 0x14 [0104.103] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161500 | out: hHeap=0x150000) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161420) returned 1 [0104.103] GetProcessHeap () returned 0x150000 [0104.103] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161420) returned 0x14 [0104.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161420 | out: hHeap=0x150000) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x161620) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x161620) returned 0x14 [0104.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x161620 | out: hHeap=0x150000) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e980) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e980) returned 0x10 [0104.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e980 | out: hHeap=0x150000) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x1617c0) returned 1 [0104.104] GetProcessHeap () returned 0x150000 [0104.104] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x1617c0) returned 0x14 [0104.104] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x1617c0 | out: hHeap=0x150000) returned 1 [0104.105] GetProcessHeap () returned 0x150000 [0104.105] GetProcessHeap () returned 0x150000 [0104.105] HeapValidate (hHeap=0x150000, dwFlags=0x0, lpMem=0x15e800) returned 1 [0104.105] GetProcessHeap () returned 0x150000 [0104.105] RtlSizeHeap (HeapHandle=0x150000, Flags=0x0, MemoryPointer=0x15e800) returned 0x10 [0104.105] HeapFree (in: hHeap=0x150000, dwFlags=0x0, lpMem=0x15e800 | out: hHeap=0x150000) returned 1 [0104.105] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0104.105] exit (_Code=0) Thread: id = 34 os_tid = 0x12f8