# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 20.04.2020 22:28:38.282 Process: id = "1" image_name = "compito italiano.doc.exe" filename = "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe" page_root = "0x1b87000" os_pid = "0xd04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xd1c [0083.219] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0084.633] RoInitialize () returned 0x1 [0084.633] RoUninitialize () returned 0x0 [0087.832] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x8febe0 | out: phkResult=0x8febe0*=0x0) returned 0x2 [0087.833] RegCloseKey (hKey=0x80000002) returned 0x0 [0087.986] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x104, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0088.028] IsAppThemed () returned 0x1 [0088.043] CoTaskMemAlloc (cb=0xf0) returned 0x9e1d68 [0088.044] CreateActCtxA (pActCtx=0x8ff388) returned 0x9d7ff4 [0088.231] CoTaskMemFree (pv=0x9e1d68) [0088.284] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc151 [0088.284] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc196 [0088.325] GetUserNameW (in: lpBuffer=0x8ff1a0, pcbBuffer=0x8ff418 | out: lpBuffer="FD1HVy", pcbBuffer=0x8ff418) returned 1 [0088.364] GetComputerNameW (in: lpBuffer=0x8ff1a0, nSize=0x8ff418 | out: lpBuffer="NQDPDE", nSize=0x8ff418) returned 1 [0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config", nBufferLength=0x105, lpBuffer=0x8fe538, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config", lpFilePart=0x0) returned 0x37 [0090.270] GetCurrentProcess () returned 0xffffffff [0090.270] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe8a0 | out: TokenHandle=0x8fe8a0*=0x2cc) returned 1 [0090.274] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0090.274] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0090.278] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe898 | out: lpFileInformation=0x8fe898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0090.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0090.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0090.280] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe8a0 | out: lpFileInformation=0x8fe8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0090.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0090.281] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0090.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe7d8) returned 1 [0090.331] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d0 [0090.331] GetFileType (hFile=0x2d0) returned 0x1 [0090.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe7d4) returned 1 [0090.331] GetFileType (hFile=0x2d0) returned 0x1 [0090.483] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe824 | out: phkResult=0x8fe824*=0x0) returned 0x2 [0090.483] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe824 | out: phkResult=0x8fe824*=0x0) returned 0x2 [0090.485] GetFileSize (in: hFile=0x2d0, lpFileSizeHigh=0x8fe894 | out: lpFileSizeHigh=0x8fe894*=0x0) returned 0x8c8f [0090.486] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe850, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe850*=0x1000, lpOverlapped=0x0) returned 1 [0090.567] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe6fc, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe6fc*=0x1000, lpOverlapped=0x0) returned 1 [0090.569] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe5b0, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe5b0*=0x1000, lpOverlapped=0x0) returned 1 [0090.570] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe5b0, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe5b0*=0x1000, lpOverlapped=0x0) returned 1 [0090.570] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe5b0, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe5b0*=0x1000, lpOverlapped=0x0) returned 1 [0090.571] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe4e8, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe4e8*=0x1000, lpOverlapped=0x0) returned 1 [0090.576] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe66c, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe66c*=0x1000, lpOverlapped=0x0) returned 1 [0090.578] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe578, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe578*=0x1000, lpOverlapped=0x0) returned 1 [0090.578] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe578, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe578*=0xc8f, lpOverlapped=0x0) returned 1 [0090.579] ReadFile (in: hFile=0x2d0, lpBuffer=0x279a0cc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fe63c, lpOverlapped=0x0 | out: lpBuffer=0x279a0cc*, lpNumberOfBytesRead=0x8fe63c*=0x0, lpOverlapped=0x0) returned 1 [0090.579] CloseHandle (hObject=0x2d0) returned 1 [0090.581] GetCurrentProcess () returned 0xffffffff [0090.581] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9e8 | out: TokenHandle=0x8fe9e8*=0x2d0) returned 1 [0090.582] GetCurrentProcess () returned 0xffffffff [0090.582] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9e8 | out: TokenHandle=0x8fe9e8*=0x2d4) returned 1 [0090.582] GetCurrentProcess () returned 0xffffffff [0090.582] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe8a0 | out: TokenHandle=0x8fe8a0*=0x2d8) returned 1 [0090.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe898 | out: lpFileInformation=0x8fe898*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config", lpFilePart=0x0) returned 0x37 [0090.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe.config" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x8fe8a0 | out: lpFileInformation=0x8fe8a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0090.584] GetCurrentProcess () returned 0xffffffff [0090.584] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9e8 | out: TokenHandle=0x8fe9e8*=0x2dc) returned 1 [0090.584] GetCurrentProcess () returned 0xffffffff [0090.584] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9e8 | out: TokenHandle=0x8fe9e8*=0x2e0) returned 1 [0090.655] GetCurrentProcess () returned 0xffffffff [0090.655] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe848 | out: TokenHandle=0x8fe848*=0x2e4) returned 1 [0090.661] GetCurrentProcess () returned 0xffffffff [0090.661] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe858 | out: TokenHandle=0x8fe858*=0x2e8) returned 1 [0090.668] GetCurrentProcess () returned 0xffffffff [0090.669] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fef88 | out: TokenHandle=0x8fef88*=0x2ec) returned 1 [0090.669] GetCurrentProcess () returned 0xffffffff [0090.669] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fef98 | out: TokenHandle=0x8fef98*=0x2f0) returned 1 [0091.304] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0091.317] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fd40000 [0093.954] AdjustWindowRectEx (in: lpRect=0x8ff3b8, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50081 | out: lpRect=0x8ff3b8) returned 1 [0093.958] GetCurrentProcess () returned 0xffffffff [0093.958] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x8ff2cc, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x8ff2cc*=0x2f8) returned 1 [0093.971] GetCurrentActCtx (in: lphActCtx=0x8ff22c | out: lphActCtx=0x8ff22c*=0x0) returned 1 [0094.134] ActivateActCtx (in: hActCtx=0x9d7ff4, lpCookie=0x8ff23c | out: hActCtx=0x9d7ff4, lpCookie=0x8ff23c) returned 1 [0094.134] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0094.137] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6fb30000 [0097.589] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0097.590] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0097.591] GetStockObject (i=5) returned 0x900015 [0097.596] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0097.599] CoTaskMemAlloc (cb=0x5a) returned 0x9ed2b0 [0097.599] RegisterClassW (lpWndClass=0x8ff0e0) returned 0xc195 [0097.860] CoTaskMemFree (pv=0x9ed2b0) [0097.861] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0097.862] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x302c2 [0097.865] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=1950089536) returned 81004006 [0097.866] GetWindowLongW (hWnd=0x302c2, nIndex=-4) returned 1950089536 [0097.868] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe900 | out: phkResult=0x8fe900*=0x310) returned 0x0 [0097.869] RegQueryValueExW (in: hKey=0x310, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x8fe920, lpData=0x0, lpcbData=0x8fe91c*=0x0 | out: lpType=0x8fe920*=0x0, lpData=0x0, lpcbData=0x8fe91c*=0x0) returned 0x2 [0097.869] RegQueryValueExW (in: hKey=0x310, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x8fe920, lpData=0x0, lpcbData=0x8fe91c*=0x0 | out: lpType=0x8fe920*=0x0, lpData=0x0, lpcbData=0x8fe91c*=0x0) returned 0x2 [0097.869] RegCloseKey (hKey=0x310) returned 0x0 [0097.870] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=81004046) returned 1950089536 [0097.871] GetWindowLongW (hWnd=0x302c2, nIndex=-4) returned 81004046 [0097.871] GetWindowLongW (hWnd=0x302c2, nIndex=-16) returned 113311744 [0097.872] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc198 [0097.874] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc199 [0097.874] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x81, wParam=0x0, lParam=0x8fec50) returned 0x1 [0097.876] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x83, wParam=0x0, lParam=0x8fec3c) returned 0x0 [0098.656] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302c2, Msg=0x1, wParam=0x0, lParam=0x8fec50) returned 0x0 [0098.657] GetClientRect (in: hWnd=0x302c2, lpRect=0x8fe938 | out: lpRect=0x8fe938) returned 1 [0098.657] GetWindowRect (in: hWnd=0x302c2, lpRect=0x8fe938 | out: lpRect=0x8fe938) returned 1 [0098.660] GetParent (hWnd=0x302c2) returned 0x0 [0098.660] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ec90001) returned 1 [0099.829] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0099.830] AdjustWindowRectEx (in: lpRect=0x8ff398, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff398) returned 1 [0102.378] GdiplusStartup (in: token=0xde5f00, input=0x8fe870, output=0x8fe8c0 | out: token=0xde5f00, output=0x8fe8c0) returned 0x0 [0102.475] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x8ff374) returned 0x0 [0103.481] GdipCreateFont (fontFamily=0x4ee8958, emSize=0x417c0000, style=0, unit=0x3, font=0x27b6af4) returned 0x0 [0103.489] GdipGetFontSize (font=0x4ee04c0, size=0x27b6af8) returned 0x0 [0103.493] GetSystemDefaultLCID () returned 0x409 [0103.494] GetStockObject (i=17) returned 0xa01c1 [0103.496] GetObjectW (in: h=0xa01c1, c=92, pv=0x8ff21c | out: pv=0x8ff21c) returned 92 [0103.497] GetDC (hWnd=0x0) returned 0x60100ce [0103.502] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0103.502] GdipCreateFontFromLogfontW (hdc=0x60100ce, logfont=0x9ed2b0, font=0x8ff2e4) returned 0x0 [0103.669] CoTaskMemFree (pv=0x9ed2b0) [0103.671] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0103.671] CoTaskMemFree (pv=0x9ed2b0) [0103.671] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0103.671] CoTaskMemFree (pv=0x9ed2b0) [0103.672] GdipGetFontUnit (font=0x4eeef38, unit=0x8ff2ac) returned 0x0 [0103.672] GdipGetFontSize (font=0x4eeef38, size=0x8ff2b0) returned 0x0 [0103.672] GdipGetFontStyle (font=0x4eeef38, style=0x8ff2a8) returned 0x0 [0103.672] GdipGetFamily (font=0x4eeef38, family=0x8ff2a4) returned 0x0 [0103.672] GdipGetFontSize (font=0x4eeef38, size=0x27b7158) returned 0x0 [0103.673] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0103.673] GetDC (hWnd=0x0) returned 0x60100ce [0103.674] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8ff2c0) returned 0x0 [0103.685] GdipGetDpiY (graphics=0x5ffacc0, dpi=0x27b7234) returned 0x0 [0103.686] GdipGetFontHeight (font=0x4eeef38, graphics=0x5ffacc0, height=0x8ff2b8) returned 0x0 [0103.686] GdipGetEmHeight (family=0x4ee8958, style=0, EmHeight=0x8ff2c0) returned 0x0 [0103.686] GdipGetLineSpacing (family=0x4ee8958, style=0, LineSpacing=0x8ff2c0) returned 0x0 [0103.686] GdipDeleteGraphics (graphics=0x5ffacc0) returned 0x0 [0103.687] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0103.687] GdipCreateFont (fontFamily=0x4ee8958, emSize=0x41040000, style=0, unit=0x3, font=0x27b7250) returned 0x0 [0103.687] GdipGetFontSize (font=0x5ffa998, size=0x27b7254) returned 0x0 [0103.687] GdipDeleteFont (font=0x4eeef38) returned 0x0 [0103.691] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.691] AdjustWindowRectEx (in: lpRect=0x8ff2f8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff2f8) returned 1 [0103.707] GetUserObjectInformationA (in: hObj=0x13c, nIndex=1, pvInfo=0x27b79bc, nLength=0xc, lpnLengthNeeded=0x8ff1d4 | out: pvInfo=0x27b79bc, lpnLengthNeeded=0x8ff1d4) returned 1 [0103.780] SetConsoleCtrlHandler (HandlerRoutine=0x4d40636, Add=1) returned 1 [0103.781] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0103.782] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0103.784] GetClassInfoW (in: hInstance=0x4f0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x27b7a20 | out: lpWndClass=0x27b7a20) returned 0 [0103.787] CoTaskMemAlloc (cb=0x58) returned 0x9d77c8 [0103.787] RegisterClassW (lpWndClass=0x8ff124) returned 0xc19b [0103.787] CoTaskMemFree (pv=0x9d77c8) [0103.788] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x50050 [0103.797] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x83, wParam=0x0, lParam=0x8fec4c) returned 0x0 [0103.797] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x1, wParam=0x0, lParam=0x8fec60) returned 0x0 [0103.798] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0103.798] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0103.805] GetSysColor (nIndex=10) returned 0xb4b4b4 [0103.805] GetSysColor (nIndex=2) returned 0xd1b499 [0103.805] GetSysColor (nIndex=9) returned 0x0 [0103.805] GetSysColor (nIndex=12) returned 0xababab [0103.805] GetSysColor (nIndex=15) returned 0xf0f0f0 [0103.805] GetSysColor (nIndex=20) returned 0xffffff [0103.805] GetSysColor (nIndex=16) returned 0xa0a0a0 [0103.805] GetSysColor (nIndex=15) returned 0xf0f0f0 [0103.805] GetSysColor (nIndex=16) returned 0xa0a0a0 [0103.805] GetSysColor (nIndex=21) returned 0x696969 [0103.805] GetSysColor (nIndex=22) returned 0xe3e3e3 [0103.805] GetSysColor (nIndex=20) returned 0xffffff [0103.805] GetSysColor (nIndex=18) returned 0x0 [0103.805] GetSysColor (nIndex=1) returned 0x0 [0103.805] GetSysColor (nIndex=27) returned 0xead1b9 [0103.806] GetSysColor (nIndex=28) returned 0xf2e4d7 [0103.806] GetSysColor (nIndex=17) returned 0x6d6d6d [0103.806] GetSysColor (nIndex=13) returned 0xd77800 [0103.806] GetSysColor (nIndex=14) returned 0xffffff [0103.806] GetSysColor (nIndex=26) returned 0xcc6600 [0103.806] GetSysColor (nIndex=11) returned 0xfcf7f4 [0103.806] GetSysColor (nIndex=3) returned 0xdbcdbf [0103.806] GetSysColor (nIndex=19) returned 0x0 [0103.806] GetSysColor (nIndex=24) returned 0xe1ffff [0103.806] GetSysColor (nIndex=23) returned 0x0 [0103.806] GetSysColor (nIndex=4) returned 0xf0f0f0 [0103.806] GetSysColor (nIndex=30) returned 0xf0f0f0 [0103.806] GetSysColor (nIndex=29) returned 0xd77800 [0103.806] GetSysColor (nIndex=7) returned 0x0 [0103.806] GetSysColor (nIndex=0) returned 0xc8c8c8 [0103.806] GetSysColor (nIndex=5) returned 0xffffff [0103.806] GetSysColor (nIndex=6) returned 0x646464 [0103.806] GetSysColor (nIndex=8) returned 0x0 [0103.807] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.807] AdjustWindowRectEx (in: lpRect=0x8ff2f8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff2f8) returned 1 [0103.811] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.811] AdjustWindowRectEx (in: lpRect=0x8ff358, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8ff358) returned 1 [0103.811] GetSystemMetrics (nIndex=59) returned 1460 [0103.812] GetSystemMetrics (nIndex=60) returned 920 [0103.812] GetSystemMetrics (nIndex=34) returned 136 [0103.812] GetSystemMetrics (nIndex=35) returned 39 [0103.812] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.812] AdjustWindowRectEx (in: lpRect=0x8ff258, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8ff258) returned 1 [0103.812] GetCurrentThreadId () returned 0xd1c [0103.812] GetCurrentThreadId () returned 0xd1c [0103.814] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0103.814] AdjustWindowRectEx (in: lpRect=0x8ff150, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff150) returned 1 [0104.071] GdipGetFamilyName (in: family=0x4ee8958, name=0x8ff03c, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0104.074] CreateCompatibleDC (hdc=0x0) returned 0x901078f [0104.075] GetCurrentObject (hdc=0x901078f, type=0x1) returned 0xb00017 [0104.075] GetCurrentObject (hdc=0x901078f, type=0x2) returned 0x900010 [0104.076] GetCurrentObject (hdc=0x901078f, type=0x7) returned 0x85000f [0104.076] GetCurrentObject (hdc=0x901078f, type=0x6) returned 0x8a01c2 [0104.076] SaveDC (hdc=0x901078f) returned 1 [0104.077] GetDeviceCaps (hdc=0x901078f, index=90) returned 96 [0104.079] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0104.079] CreateFontIndirectW (lplf=0x9ed2b0) returned 0x390a07b4 [0104.079] CoTaskMemFree (pv=0x9ed2b0) [0104.080] GetObjectW (in: h=0x390a07b4, c=92, pv=0x8ff000 | out: pv=0x8ff000) returned 92 [0104.080] GetCurrentObject (hdc=0x901078f, type=0x6) returned 0x8a01c2 [0104.080] GetObjectW (in: h=0x8a01c2, c=92, pv=0x8fef68 | out: pv=0x8fef68) returned 92 [0104.081] SelectObject (hdc=0x901078f, h=0x390a07b4) returned 0x8a01c2 [0104.081] GetMapMode (hdc=0x901078f) returned 1 [0104.081] GetTextMetricsW (in: hdc=0x901078f, lptm=0x8ff030 | out: lptm=0x8ff030) returned 1 [0104.084] DrawTextExW (in: hdc=0x901078f, lpchText="CRACKED BY MAMO434376", cchText=21, lprc=0x8ff13c, format=0x2400, lpdtp=0x27b84e8 | out: lpchText="CRACKED BY MAMO434376", lprc=0x8ff13c) returned 25 [0104.235] CreateCompatibleDC (hdc=0x0) returned 0x65010666 [0104.235] GetDC (hWnd=0x0) returned 0x60100ce [0104.235] GdipCreateFromHDC (hdc=0x60100ce, graphics=0x8ff180) returned 0x0 [0104.236] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0104.236] GdipGetLogFontW (font=0x5ffa998, graphics=0x5ffacc0, logfontW=0x9ed2b0) returned 0x0 [0104.241] CoTaskMemFree (pv=0x9ed2b0) [0104.241] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0104.241] CoTaskMemFree (pv=0x9ed2b0) [0104.242] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0104.242] CoTaskMemFree (pv=0x9ed2b0) [0104.242] GdipDeleteGraphics (graphics=0x5ffacc0) returned 0x0 [0104.242] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0104.242] CoTaskMemAlloc (cb=0x5c) returned 0x9ed2b0 [0104.242] CreateFontIndirectW (lplf=0x9ed2b0) returned 0x2e0a051e [0104.243] CoTaskMemFree (pv=0x9ed2b0) [0104.243] SelectObject (hdc=0x65010666, h=0x2e0a051e) returned 0x8a01c2 [0104.243] GetTextMetricsW (in: hdc=0x65010666, lptm=0x8ff28c | out: lptm=0x8ff28c) returned 1 [0104.244] GetTextExtentPoint32W (in: hdc=0x65010666, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x27b88e8 | out: psizl=0x27b88e8) returned 1 [0104.245] SelectObject (hdc=0x65010666, h=0x8a01c2) returned 0x2e0a051e [0104.247] DeleteDC (hdc=0x65010666) returned 1 [0104.247] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0104.248] AdjustWindowRectEx (in: lpRect=0x8fefd4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fefd4) returned 1 [0104.248] AdjustWindowRectEx (in: lpRect=0x8ff218, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8ff218) returned 1 [0104.248] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0104.248] AdjustWindowRectEx (in: lpRect=0x8fef4c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8fef4c) returned 1 [0104.248] AdjustWindowRectEx (in: lpRect=0x8ff050, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50080 | out: lpRect=0x8ff050) returned 1 [0104.248] GetSystemMetrics (nIndex=34) returned 136 [0104.249] GetSystemMetrics (nIndex=35) returned 39 [0104.249] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0104.249] AdjustWindowRectEx (in: lpRect=0x8ff210, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff210) returned 1 [0104.249] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0104.249] AdjustWindowRectEx (in: lpRect=0x8ff074, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8ff074) returned 1 [0104.249] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fd40000 [0104.250] AdjustWindowRectEx (in: lpRect=0x8feecc, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x8feecc) returned 1 [0104.250] GetCurrentActCtx (in: lphActCtx=0x8ff3fc | out: lphActCtx=0x8ff3fc*=0x0) returned 1 [0104.250] ActivateActCtx (in: hActCtx=0x9d7ff4, lpCookie=0x8ff40c | out: hActCtx=0x9d7ff4, lpCookie=0x8ff40c) returned 1 [0104.250] GetCurrentActCtx (in: lphActCtx=0x8ff21c | out: lphActCtx=0x8ff21c*=0x9d7ff4) returned 1 [0104.251] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.251] AdjustWindowRectEx (in: lpRect=0x8ff15c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x8ff15c) returned 1 [0104.251] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0104.251] CreateWindowExW (dwExStyle=0x50080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="CRACKED", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=601, nHeight=325, hWndParent=0x0, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x70030 [0104.291] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=1950089536) returned 81004006 [0104.291] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 1950089536 [0104.291] SetWindowLongW (hWnd=0x70030, nIndex=-4, dwNewLong=81004166) returned 1950089536 [0104.291] GetWindowLongW (hWnd=0x70030, nIndex=-4) returned 81004166 [0104.291] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 114229248 [0104.292] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x81, wParam=0x0, lParam=0x8fec40) returned 0x1 [0104.293] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x83, wParam=0x0, lParam=0x8fec2c) returned 0x0 [0104.295] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x1, wParam=0x0, lParam=0x8fec40) returned 0x0 [0104.295] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe8f8 | out: lpRect=0x8fe8f8) returned 1 [0104.295] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fe8f8 | out: lpRect=0x8fe8f8) returned 1 [0104.295] SetWindowTextW (hWnd=0x70030, lpString="CRACKED") returned 1 [0104.295] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xc, wParam=0x0, lParam=0x27b68b8) returned 0x1 [0104.298] GetStartupInfoW (in: lpStartupInfo=0x27b8bbc | out: lpStartupInfo=0x27b8bbc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0104.300] GetParent (hWnd=0x70030) returned 0x0 [0104.301] SetWindowLongW (hWnd=0x70030, nIndex=-8, dwNewLong=0) returned 0 [0104.308] GetSystemMetrics (nIndex=11) returned 32 [0104.308] GetSystemMetrics (nIndex=12) returned 32 [0104.308] GetDC (hWnd=0x0) returned 0x60100ce [0104.308] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0104.308] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0104.308] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0104.309] CreateIconFromResourceEx (presbits=0x27bb61c, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x8020d [0104.311] GetSystemMetrics (nIndex=49) returned 16 [0104.311] GetSystemMetrics (nIndex=50) returned 16 [0104.311] CreateIconFromResourceEx (presbits=0x27bc700, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x12a029b [0104.313] SendMessageW (hWnd=0x70030, Msg=0x80, wParam=0x0, lParam=0x12a029b) returned 0x0 [0104.313] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x80, wParam=0x0, lParam=0x12a029b) returned 0x0 [0104.316] SendMessageW (hWnd=0x70030, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0104.316] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0104.316] GetSystemMenu (hWnd=0x70030, bRevert=0) returned 0xc0083 [0104.320] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8ff22c | out: lpwndpl=0x8ff22c) returned 1 [0104.321] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0104.321] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0104.321] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0104.321] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0104.321] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0104.321] GetClientRect (in: hWnd=0x70030, lpRect=0x8ff270 | out: lpRect=0x8ff270) returned 1 [0104.321] GetClientRect (in: hWnd=0x70030, lpRect=0x8ff1d0 | out: lpRect=0x8ff1d0) returned 1 [0104.321] GetWindowRect (in: hWnd=0x70030, lpRect=0x8ff1d0 | out: lpRect=0x8ff1d0) returned 1 [0104.322] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.322] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 114229248 [0104.322] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.322] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.323] GetSystemMetrics (nIndex=42) returned 0 [0104.323] GetWindowTextW (in: hWnd=0x70030, lpString=0x8ff150, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.323] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8ff150) returned 0x7 [0104.323] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.324] GetSystemMetrics (nIndex=42) returned 0 [0104.324] GetWindowTextW (in: hWnd=0x70030, lpString=0x8ff150, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8ff150) returned 0x7 [0104.324] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 114229248 [0104.324] GetWindowLongW (hWnd=0x70030, nIndex=-20) returned 328064 [0104.324] SetWindowLongW (hWnd=0x70030, nIndex=-16, dwNewLong=47120384) returned 114229248 [0104.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7c, wParam=0xfffffff0, lParam=0x8ff1cc) returned 0x0 [0104.324] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7d, wParam=0xfffffff0, lParam=0x8ff1cc) returned 0x0 [0104.328] SetWindowLongW (hWnd=0x70030, nIndex=-20, dwNewLong=327808) returned 328064 [0104.328] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7c, wParam=0xffffffec, lParam=0x8ff1cc) returned 0x0 [0104.328] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7d, wParam=0xffffffec, lParam=0x8ff1cc) returned 0x0 [0104.329] SetWindowPos (hWnd=0x70030, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0104.329] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8ff1e4) returned 0x0 [0104.329] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x83, wParam=0x1, lParam=0x8ff1bc) returned 0x0 [0104.332] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8fef10 | out: lpwndpl=0x8fef10) returned 1 [0104.332] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8ff1e4) returned 0x0 [0104.333] GetClientRect (in: hWnd=0x70030, lpRect=0x8feec0 | out: lpRect=0x8feec0) returned 1 [0104.333] GetWindowRect (in: hWnd=0x70030, lpRect=0x8feec0 | out: lpRect=0x8feec0) returned 1 [0104.334] RedrawWindow (hWnd=0x70030, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0104.334] GetSystemMenu (hWnd=0x70030, bRevert=0) returned 0xc0083 [0104.334] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8ff21c | out: lpwndpl=0x8ff21c) returned 1 [0104.334] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0104.334] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0104.334] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0104.334] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0104.334] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0104.334] ShowWindow (hWnd=0x70030, nCmdShow=5) returned 0 [0104.335] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.335] GetCurrentActCtx (in: lphActCtx=0x8fee6c | out: lphActCtx=0x8fee6c*=0x9d7ff4) returned 1 [0104.335] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.335] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x27bcd38 | out: lpWndClass=0x27bcd38) returned 1 [0104.337] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0104.337] CoTaskMemAlloc (cb=0x56) returned 0x9d79a8 [0104.337] RegisterClassW (lpWndClass=0x8fed20) returned 0xc19c [0104.337] CoTaskMemFree (pv=0x9d79a8) [0104.338] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0104.338] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="CRACKED BY MAMO434376", dwStyle=0x5600000d, X=141, Y=117, nWidth=293, nHeight=25, hWndParent=0x70030, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x6002e [0104.338] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=1874504640) returned 81004206 [0104.338] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 1874504640 [0104.339] SetWindowLongW (hWnd=0x6002e, nIndex=-4, dwNewLong=81004246) returned 1874504640 [0104.339] GetWindowLongW (hWnd=0x6002e, nIndex=-4) returned 81004246 [0104.339] GetWindowLongW (hWnd=0x6002e, nIndex=-16) returned 1174405133 [0104.339] GetWindowLongW (hWnd=0x6002e, nIndex=-12) returned 0 [0104.339] SetWindowLongW (hWnd=0x6002e, nIndex=-12, dwNewLong=393262) returned 0 [0104.339] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x81, wParam=0x0, lParam=0x8fe890) returned 0x1 [0104.340] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x83, wParam=0x0, lParam=0x8fe87c) returned 0x0 [0104.340] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x1, wParam=0x0, lParam=0x8fe890) returned 0x0 [0104.342] GetWindow (hWnd=0x6002e, uCmd=0x3) returned 0x0 [0104.342] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe53c | out: lpRect=0x8fe53c) returned 1 [0104.342] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe53c | out: lpRect=0x8fe53c) returned 1 [0104.342] GetParent (hWnd=0x6002e) returned 0x70030 [0104.342] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x70030, lpPoints=0x8fe53c, cPoints=0x2 | out: lpPoints=0x8fe53c) returned -3670050 [0104.343] SetWindowTextW (hWnd=0x6002e, lpString="CRACKED BY MAMO434376") returned 1 [0104.343] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0xc, wParam=0x0, lParam=0x27b6868) returned 0x1 [0104.343] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x5, wParam=0x0, lParam=0x190125) returned 0x0 [0104.344] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x3, wParam=0x0, lParam=0x75008d) returned 0x0 [0104.344] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe594 | out: lpRect=0x8fe594) returned 1 [0104.344] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe594 | out: lpRect=0x8fe594) returned 1 [0104.344] GetParent (hWnd=0x6002e) returned 0x70030 [0104.344] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x70030, lpPoints=0x8fe594, cPoints=0x2 | out: lpPoints=0x8fe594) returned -3670050 [0104.344] SendMessageW (hWnd=0x6002e, Msg=0x2210, wParam=0x2e0001, lParam=0x6002e) returned 0x0 [0104.344] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x2210, wParam=0x2e0001, lParam=0x6002e) returned 0x0 [0104.344] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0104.345] GetParent (hWnd=0x6002e) returned 0x70030 [0104.345] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.345] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.345] GetSystemMetrics (nIndex=42) returned 0 [0104.345] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fee14, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.345] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8fee14) returned 0x7 [0104.491] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0104.493] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 114229248 [0104.493] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.493] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.493] GetSystemMetrics (nIndex=42) returned 0 [0104.493] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fecf4, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.493] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8fecf4) returned 0x7 [0104.493] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.493] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.494] GetSystemMetrics (nIndex=42) returned 0 [0104.494] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fecf4, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.494] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8fecf4) returned 0x7 [0104.494] GetWindowLongW (hWnd=0x70030, nIndex=-16) returned 114229248 [0104.494] GetWindowLongW (hWnd=0x70030, nIndex=-20) returned 328064 [0104.494] SetWindowLongW (hWnd=0x70030, nIndex=-16, dwNewLong=315555840) returned 114229248 [0104.494] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fed74) returned 0x0 [0104.529] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fed74) returned 0x0 [0104.529] SetWindowLongW (hWnd=0x70030, nIndex=-20, dwNewLong=852096) returned 328064 [0104.530] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7c, wParam=0xffffffec, lParam=0x8fed74) returned 0x0 [0104.531] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x7d, wParam=0xffffffec, lParam=0x8fed74) returned 0x0 [0104.534] SetWindowPos (hWnd=0x70030, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0104.534] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x46, wParam=0x0, lParam=0x8fed8c) returned 0x0 [0104.534] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x83, wParam=0x1, lParam=0x8fed64) returned 0x0 [0104.658] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x85, wParam=0x4e0407b1, lParam=0x0) returned 0x0 [0104.660] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8fead4 | out: lpwndpl=0x8fead4) returned 1 [0104.660] GetClientRect (in: hWnd=0x70030, lpRect=0x8fea80 | out: lpRect=0x8fea80) returned 1 [0104.660] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0104.660] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0104.660] GetSystemMetrics (nIndex=42) returned 0 [0104.660] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fe948, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0104.660] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8fe948) returned 0x7 [0104.660] GetClientRect (in: hWnd=0x70030, lpRect=0x8fe988 | out: lpRect=0x8fe988) returned 1 [0104.662] GetSystemMetrics (nIndex=80) returned 1 [0104.722] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4d406fe, dwData=0x0) returned 1 [0104.725] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x8fe5e8 | out: lpmi=0x8fe5e8) returned 1 [0104.726] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x120107ad [0104.726] GetDeviceCaps (hdc=0x120107ad, index=12) returned 32 [0104.726] GetDeviceCaps (hdc=0x120107ad, index=14) returned 1 [0104.726] DeleteDC (hdc=0x120107ad) returned 1 [0104.727] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0104.727] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0104.727] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x6b0507b6 [0104.727] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0104.727] SaveDC (hdc=0x10105d6) returned 1 [0104.727] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0104.728] CreateSolidBrush (color=0xf0f0f0) returned 0x171007c0 [0104.729] FillRect (hDC=0x10105d6, lprc=0x8fe828, hbr=0x171007c0) returned 1 [0104.729] DeleteObject (ho=0x171007c0) returned 1 [0104.729] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0104.768] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8feab8 | out: lpwndpl=0x8feab8) returned 1 [0104.768] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x47, wParam=0x0, lParam=0x8fed8c) returned 0x0 [0104.768] GetClientRect (in: hWnd=0x70030, lpRect=0x8fea68 | out: lpRect=0x8fea68) returned 1 [0104.768] GetWindowRect (in: hWnd=0x70030, lpRect=0x8fea68 | out: lpRect=0x8fea68) returned 1 [0104.769] RedrawWindow (hWnd=0x70030, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0104.770] GetSystemMenu (hWnd=0x70030, bRevert=0) returned 0xc0083 [0104.770] GetWindowPlacement (in: hWnd=0x70030, lpwndpl=0x8fedc0 | out: lpwndpl=0x8fedc0) returned 1 [0104.770] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0104.770] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0104.770] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0104.770] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0104.770] EnableMenuItem (hMenu=0xc0083, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0104.777] SetLayeredWindowAttributes (hwnd=0x70030, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0104.789] GetCurrentThreadId () returned 0xd1c [0104.796] EnumThreadWindows (dwThreadId=0xd1c, lpfn=0x4d40726, lParam=0x70030) returned 1 [0105.059] GetWindowLongW (hWnd=0x70030, nIndex=-8) returned 0 [0105.059] GetWindowLongW (hWnd=0x50050, nIndex=-8) returned 0 [0105.059] GetWindowLongW (hWnd=0x602ac, nIndex=-8) returned 327760 [0105.068] GetParent (hWnd=0x70030) returned 0x0 [0105.071] GetWindowThreadProcessId (in: hWnd=0x6002e, lpdwProcessId=0x8fedd8 | out: lpdwProcessId=0x8fedd8) returned 0xd1c [0105.081] GetCurrentActCtx (in: lphActCtx=0x8fed40 | out: lphActCtx=0x8fed40*=0x9d7ff4) returned 1 [0105.081] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0105.082] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0105.082] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x70036 [0105.083] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=1950089536) returned 81004006 [0105.083] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 1950089536 [0105.083] SetWindowLongW (hWnd=0x70036, nIndex=-4, dwNewLong=81004366) returned 1950089536 [0105.084] GetWindowLongW (hWnd=0x70036, nIndex=-4) returned 81004366 [0105.084] GetWindowLongW (hWnd=0x70036, nIndex=-16) returned 113311744 [0105.084] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x24, wParam=0x0, lParam=0x8fe76c) returned 0x0 [0105.084] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x81, wParam=0x0, lParam=0x8fe760) returned 0x1 [0105.085] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x83, wParam=0x0, lParam=0x8fe74c) returned 0x0 [0105.085] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x1, wParam=0x0, lParam=0x8fe760) returned 0x0 [0105.085] GetClientRect (in: hWnd=0x70036, lpRect=0x8fe42c | out: lpRect=0x8fe42c) returned 1 [0105.085] GetWindowRect (in: hWnd=0x70036, lpRect=0x8fe42c | out: lpRect=0x8fe42c) returned 1 [0105.086] SetWindowTextW (hWnd=0x70036, lpString="WindowsFormsParkingWindow") returned 1 [0105.086] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0xc, wParam=0x0, lParam=0x27bdb64) returned 0x1 [0105.086] GetParent (hWnd=0x70036) returned 0x0 [0105.087] SetParent (hWndChild=0x6002e, hWndNewParent=0x70036) returned 0x70030 [0105.087] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0105.088] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x8fed34) returned 0x0 [0105.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0105.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x8fed34) returned 0x0 [0105.089] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x3, wParam=0x0, lParam=0x75008d) returned 0x0 [0105.089] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe2c4 | out: lpRect=0x8fe2c4) returned 1 [0105.089] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe2c4 | out: lpRect=0x8fe2c4) returned 1 [0105.089] GetParent (hWnd=0x6002e) returned 0x70036 [0105.090] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x70036, lpPoints=0x8fe2c4, cPoints=0x2 | out: lpPoints=0x8fe2c4) returned -1966088 [0105.090] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe9f4 | out: lpRect=0x8fe9f4) returned 1 [0105.090] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe9f4 | out: lpRect=0x8fe9f4) returned 1 [0105.090] GetParent (hWnd=0x6002e) returned 0x70036 [0105.090] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x70036, lpPoints=0x8fe9f4, cPoints=0x2 | out: lpPoints=0x8fe9f4) returned -1966088 [0105.090] GetParent (hWnd=0x6002e) returned 0x70036 [0105.090] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0105.090] GetWindowLongW (hWnd=0x70030, nIndex=-20) returned 852352 [0105.091] DestroyWindow (hWnd=0x70030) returned 1 [0105.091] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0105.102] GetWindowTextLengthW (hWnd=0x70030) returned 7 [0105.102] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.103] GetSystemMetrics (nIndex=42) returned 0 [0105.103] GetWindowTextW (in: hWnd=0x70030, lpString=0x8fe8c4, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.103] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0xd, wParam=0x8, lParam=0x8fe8c4) returned 0x7 [0105.103] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0105.103] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70030, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0105.106] GetCurrentActCtx (in: lphActCtx=0x8fed20 | out: lphActCtx=0x8fed20*=0x9d7ff4) returned 1 [0105.106] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0105.106] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0105.106] CreateWindowExW (dwExStyle=0x90080, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", lpWindowName="CRACKED", dwStyle=0x2cf0000, X=26, Y=26, nWidth=601, nHeight=325, hWndParent=0x0, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x8005c [0105.107] SetWindowLongW (hWnd=0x8005c, nIndex=-4, dwNewLong=1950089536) returned 81004006 [0105.107] GetWindowLongW (hWnd=0x8005c, nIndex=-4) returned 1950089536 [0105.107] SetWindowLongW (hWnd=0x8005c, nIndex=-4, dwNewLong=81004406) returned 1950089536 [0105.107] GetWindowLongW (hWnd=0x8005c, nIndex=-4) returned 81004406 [0105.107] GetWindowLongW (hWnd=0x8005c, nIndex=-16) returned 114229248 [0105.109] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x81, wParam=0x0, lParam=0x8fe740) returned 0x1 [0105.110] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x0, lParam=0x8fe72c) returned 0x0 [0105.111] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x1, wParam=0x0, lParam=0x8fe740) returned 0x0 [0105.111] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe3f8 | out: lpRect=0x8fe3f8) returned 1 [0105.111] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fe3f8 | out: lpRect=0x8fe3f8) returned 1 [0105.111] SetWindowTextW (hWnd=0x8005c, lpString="CRACKED") returned 1 [0105.111] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xc, wParam=0x0, lParam=0x27bddfc) returned 0x1 [0105.112] SetLayeredWindowAttributes (hwnd=0x8005c, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0105.123] GetStartupInfoW (in: lpStartupInfo=0x27be0d0 | out: lpStartupInfo=0x27be0d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0105.124] GetParent (hWnd=0x8005c) returned 0x0 [0105.124] GetStockObject (i=5) returned 0x900015 [0105.125] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0105.125] CoTaskMemAlloc (cb=0x5a) returned 0x9ed2b0 [0105.125] RegisterClassW (lpWndClass=0x8febfc) returned 0xc19d [0105.126] CoTaskMemFree (pv=0x9ed2b0) [0105.126] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0105.126] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x302b0 [0105.126] SetWindowLongW (hWnd=0x302b0, nIndex=-4, dwNewLong=1950089536) returned 81004446 [0105.127] GetWindowLongW (hWnd=0x302b0, nIndex=-4) returned 1950089536 [0105.127] SetWindowLongW (hWnd=0x302b0, nIndex=-4, dwNewLong=81004486) returned 1950089536 [0105.127] GetWindowLongW (hWnd=0x302b0, nIndex=-4) returned 81004486 [0105.127] GetWindowLongW (hWnd=0x302b0, nIndex=-16) returned 79691776 [0105.131] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x24, wParam=0x0, lParam=0x8fe774) returned 0x0 [0105.131] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x81, wParam=0x0, lParam=0x8fe768) returned 0x1 [0105.132] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x83, wParam=0x0, lParam=0x8fe754) returned 0x0 [0105.133] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x1, wParam=0x0, lParam=0x8fe768) returned 0x0 [0105.134] SetWindowLongW (hWnd=0x8005c, nIndex=-8, dwNewLong=197296) returned 0 [0105.135] SendMessageW (hWnd=0x8005c, Msg=0x80, wParam=0x0, lParam=0x12a029b) returned 0x0 [0105.135] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x80, wParam=0x0, lParam=0x12a029b) returned 0x0 [0105.135] SendMessageW (hWnd=0x8005c, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0105.135] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0105.152] GetSystemMenu (hWnd=0x8005c, bRevert=0) returned 0xd0083 [0105.152] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fed30 | out: lpwndpl=0x8fed30) returned 1 [0105.152] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0105.152] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0105.152] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0105.152] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0105.153] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0105.153] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fed74 | out: lpRect=0x8fed74) returned 1 [0105.153] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fecd4 | out: lpRect=0x8fecd4) returned 1 [0105.153] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fecd4 | out: lpRect=0x8fecd4) returned 1 [0105.153] SetWindowPos (hWnd=0x8005c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0105.153] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x46, wParam=0x0, lParam=0x8fec3c) returned 0x0 [0105.166] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.171] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fe984 | out: lpwndpl=0x8fe984) returned 1 [0105.172] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe930 | out: lpRect=0x8fe930) returned 1 [0105.172] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.172] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.172] GetSystemMetrics (nIndex=42) returned 0 [0105.172] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe7f8, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.172] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe7f8) returned 0x7 [0105.172] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe838 | out: lpRect=0x8fe838) returned 1 [0105.172] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0105.172] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0105.172] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x290506b6 [0105.172] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0105.172] SaveDC (hdc=0x10105d6) returned 1 [0105.172] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0105.172] CreateSolidBrush (color=0xf0f0f0) returned 0x181007c0 [0105.173] FillRect (hDC=0x10105d6, lprc=0x8fe6d8, hbr=0x181007c0) returned 1 [0105.173] DeleteObject (ho=0x181007c0) returned 1 [0105.173] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0105.173] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fe968 | out: lpwndpl=0x8fe968) returned 1 [0105.173] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x47, wParam=0x0, lParam=0x8fec3c) returned 0x0 [0105.173] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0105.173] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fe918 | out: lpRect=0x8fe918) returned 1 [0105.178] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x1, lParam=0x8fe754) returned 0x0 [0105.189] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.195] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fe4c4 | out: lpwndpl=0x8fe4c4) returned 1 [0105.195] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe470 | out: lpRect=0x8fe470) returned 1 [0105.196] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.196] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.196] GetSystemMetrics (nIndex=42) returned 0 [0105.196] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe338, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.196] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe338) returned 0x7 [0105.196] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe378 | out: lpRect=0x8fe378) returned 1 [0105.196] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0105.196] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0105.196] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x290506b6 [0105.196] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0105.196] SaveDC (hdc=0xf0105ee) returned 1 [0105.196] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0105.196] CreateSolidBrush (color=0xf0f0f0) returned 0x191007c0 [0105.196] FillRect (hDC=0xf0105ee, lprc=0x8fe218, hbr=0x191007c0) returned 1 [0105.197] DeleteObject (ho=0x191007c0) returned 1 [0105.197] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0105.197] SetWindowLongW (hWnd=0x8005c, nIndex=-8, dwNewLong=197296) returned 197296 [0105.199] SendMessageW (hWnd=0x302b0, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0105.199] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x80, wParam=0x1, lParam=0x8020d) returned 0x0 [0105.201] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0105.201] GetWindowLongW (hWnd=0x8005c, nIndex=-16) returned 382664704 [0105.201] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.201] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.201] GetSystemMetrics (nIndex=42) returned 0 [0105.201] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fec54, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.201] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fec54) returned 0x7 [0105.201] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.202] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.202] GetSystemMetrics (nIndex=42) returned 0 [0105.202] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fec54, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.202] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fec54) returned 0x7 [0105.202] GetWindowLongW (hWnd=0x8005c, nIndex=-16) returned 382664704 [0105.202] GetWindowLongW (hWnd=0x8005c, nIndex=-20) returned 590208 [0105.202] SetWindowLongW (hWnd=0x8005c, nIndex=-16, dwNewLong=315555840) returned 382664704 [0105.202] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x7c, wParam=0xfffffff0, lParam=0x8fecd4) returned 0x0 [0105.203] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x7d, wParam=0xfffffff0, lParam=0x8fecd4) returned 0x0 [0105.203] SetWindowLongW (hWnd=0x8005c, nIndex=-20, dwNewLong=589952) returned 590208 [0105.203] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x7c, wParam=0xffffffec, lParam=0x8fecd4) returned 0x0 [0105.204] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x7d, wParam=0xffffffec, lParam=0x8fecd4) returned 0x0 [0105.204] SetWindowPos (hWnd=0x8005c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0105.205] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x46, wParam=0x0, lParam=0x8fecec) returned 0x0 [0105.205] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x1, lParam=0x8fecc4) returned 0x0 [0105.230] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.236] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fea34 | out: lpwndpl=0x8fea34) returned 1 [0105.236] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe9e0 | out: lpRect=0x8fe9e0) returned 1 [0105.237] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.237] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.237] GetSystemMetrics (nIndex=42) returned 0 [0105.237] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe8a8, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.237] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe8a8) returned 0x7 [0105.237] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe8e8 | out: lpRect=0x8fe8e8) returned 1 [0105.237] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0105.237] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0105.237] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x290506b6 [0105.237] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0105.237] SaveDC (hdc=0x10105d6) returned 1 [0105.240] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0105.240] CreateSolidBrush (color=0xf0f0f0) returned 0x1a1007c0 [0105.240] FillRect (hDC=0x10105d6, lprc=0x8fe788, hbr=0x1a1007c0) returned 1 [0105.240] DeleteObject (ho=0x1a1007c0) returned 1 [0105.240] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0105.241] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fea18 | out: lpwndpl=0x8fea18) returned 1 [0105.241] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x47, wParam=0x0, lParam=0x8fecec) returned 0x0 [0105.241] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe9c8 | out: lpRect=0x8fe9c8) returned 1 [0105.241] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fe9c8 | out: lpRect=0x8fe9c8) returned 1 [0105.242] RedrawWindow (hWnd=0x8005c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0105.242] GetSystemMenu (hWnd=0x8005c, bRevert=0) returned 0xd0083 [0105.242] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fed20 | out: lpwndpl=0x8fed20) returned 1 [0105.242] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0105.242] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0105.242] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0105.242] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0105.242] EnableMenuItem (hMenu=0xd0083, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0105.242] SetParent (hWndChild=0x6002e, hWndNewParent=0x8005c) returned 0x70036 [0105.242] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0105.243] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x8fed4c) returned 0x0 [0105.255] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0105.256] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x8fed4c) returned 0x0 [0105.256] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x3, wParam=0x0, lParam=0x75008d) returned 0x0 [0105.256] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe2dc | out: lpRect=0x8fe2dc) returned 1 [0105.256] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe2dc | out: lpRect=0x8fe2dc) returned 1 [0105.256] GetParent (hWnd=0x6002e) returned 0x8005c [0105.256] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fe2dc, cPoints=0x2 | out: lpPoints=0x8fe2dc) returned -3670050 [0105.256] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fea0c | out: lpRect=0x8fea0c) returned 1 [0105.256] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fea0c | out: lpRect=0x8fea0c) returned 1 [0105.256] GetParent (hWnd=0x6002e) returned 0x8005c [0105.256] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fea0c, cPoints=0x2 | out: lpPoints=0x8fea0c) returned -3670050 [0105.256] GetParent (hWnd=0x6002e) returned 0x8005c [0105.256] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0105.256] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x8fed4c) returned 0x0 [0105.259] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fea94 | out: lpwndpl=0x8fea94) returned 1 [0105.259] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fea40 | out: lpRect=0x8fea40) returned 1 [0105.259] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.259] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.259] GetSystemMetrics (nIndex=42) returned 0 [0105.260] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe908, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.260] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe908) returned 0x7 [0105.260] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe948 | out: lpRect=0x8fe948) returned 1 [0105.260] GetCurrentObject (hdc=0x10105d6, type=0x1) returned 0xb00017 [0105.260] GetCurrentObject (hdc=0x10105d6, type=0x2) returned 0x900010 [0105.260] GetCurrentObject (hdc=0x10105d6, type=0x7) returned 0x290506b6 [0105.260] GetCurrentObject (hdc=0x10105d6, type=0x6) returned 0x8a01c2 [0105.260] SaveDC (hdc=0x10105d6) returned 1 [0105.260] GetNearestColor (hdc=0x10105d6, color=0xf0f0f0) returned 0xf0f0f0 [0105.260] CreateSolidBrush (color=0xf0f0f0) returned 0x1b1007c0 [0105.260] FillRect (hDC=0x10105d6, lprc=0x8fe7e8, hbr=0x1b1007c0) returned 1 [0105.263] DeleteObject (ho=0x1b1007c0) returned 1 [0105.263] RestoreDC (hdc=0x10105d6, nSavedDC=-1) returned 1 [0105.264] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.264] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x8fed4c) returned 0x0 [0105.264] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fea0c | out: lpRect=0x8fea0c) returned 1 [0105.264] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fea0c | out: lpRect=0x8fea0c) returned 1 [0105.264] GetParent (hWnd=0x6002e) returned 0x8005c [0105.264] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fea0c, cPoints=0x2 | out: lpPoints=0x8fea0c) returned -3670050 [0105.264] GetParent (hWnd=0x6002e) returned 0x8005c [0105.265] GetWindow (hWnd=0x6002e, uCmd=0x3) returned 0x0 [0105.265] GetFocus () returned 0x0 [0105.265] GetParent (hWnd=0x6002e) returned 0x8005c [0105.265] GetWindowLongW (hWnd=0x6002e, nIndex=-20) returned 0 [0105.265] DestroyWindow (hWnd=0x6002e) returned 1 [0105.265] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0105.265] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x210, wParam=0x2e0002, lParam=0x6002e) returned 0x0 [0105.265] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0105.265] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x46, wParam=0x0, lParam=0x8fec3c) returned 0x0 [0105.279] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fe984 | out: lpwndpl=0x8fe984) returned 1 [0105.279] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe930 | out: lpRect=0x8fe930) returned 1 [0105.279] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0105.279] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0105.279] GetSystemMetrics (nIndex=42) returned 0 [0105.279] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe7f8, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0105.279] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe7f8) returned 0x7 [0105.280] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe838 | out: lpRect=0x8fe838) returned 1 [0105.280] GetCurrentObject (hdc=0xf0105ee, type=0x1) returned 0xb00017 [0105.280] GetCurrentObject (hdc=0xf0105ee, type=0x2) returned 0x900010 [0105.280] GetCurrentObject (hdc=0xf0105ee, type=0x7) returned 0x290506b6 [0105.280] GetCurrentObject (hdc=0xf0105ee, type=0x6) returned 0x8a01c2 [0105.280] SaveDC (hdc=0xf0105ee) returned 1 [0105.280] GetNearestColor (hdc=0xf0105ee, color=0xf0f0f0) returned 0xf0f0f0 [0105.280] CreateSolidBrush (color=0xf0f0f0) returned 0x1c1007c0 [0105.280] FillRect (hDC=0xf0105ee, lprc=0x8fe6d8, hbr=0x1c1007c0) returned 1 [0105.283] DeleteObject (ho=0x1c1007c0) returned 1 [0105.283] RestoreDC (hdc=0xf0105ee, nSavedDC=-1) returned 1 [0105.284] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x47, wParam=0x0, lParam=0x8fec3c) returned 0x0 [0105.284] GetClientRect (in: hWnd=0x6002e, lpRect=0x8fe8fc | out: lpRect=0x8fe8fc) returned 1 [0105.284] GetWindowRect (in: hWnd=0x6002e, lpRect=0x8fe8fc | out: lpRect=0x8fe8fc) returned 1 [0105.284] GetParent (hWnd=0x6002e) returned 0x8005c [0105.284] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fe8fc, cPoints=0x2 | out: lpPoints=0x8fe8fc) returned -3670050 [0105.284] GetParent (hWnd=0x6002e) returned 0x8005c [0105.284] GetWindowTextLengthW (hWnd=0x6002e) returned 21 [0105.284] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x15 [0105.284] GetSystemMetrics (nIndex=42) returned 0 [0105.284] GetWindowTextW (in: hWnd=0x6002e, lpString=0x8fe818, nMaxCount=22 | out: lpString="CRACKED BY MAMO434376") returned 21 [0105.285] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0xd, wParam=0x16, lParam=0x8fe818) returned 0x15 [0105.285] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0105.285] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x6002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0105.286] GetCurrentActCtx (in: lphActCtx=0x8fecf4 | out: lphActCtx=0x8fecf4*=0x9d7ff4) returned 1 [0105.287] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6fb30000 [0105.287] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0105.287] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", lpWindowName="CRACKED BY MAMO434376", dwStyle=0x5600000d, X=141, Y=117, nWidth=293, nHeight=25, hWndParent=0x8005c, hMenu=0x0, hInstance=0x4f0000, lpParam=0x0) returned 0x7002e [0105.288] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=1874504640) returned 81004206 [0105.288] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 1874504640 [0105.288] SetWindowLongW (hWnd=0x7002e, nIndex=-4, dwNewLong=81004526) returned 1874504640 [0105.288] GetWindowLongW (hWnd=0x7002e, nIndex=-4) returned 81004526 [0105.288] GetWindowLongW (hWnd=0x7002e, nIndex=-16) returned 1174405133 [0105.288] GetWindowLongW (hWnd=0x7002e, nIndex=-12) returned 0 [0105.289] SetWindowLongW (hWnd=0x7002e, nIndex=-12, dwNewLong=458798) returned 0 [0105.289] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x81, wParam=0x0, lParam=0x8fe718) returned 0x1 [0105.290] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x83, wParam=0x0, lParam=0x8fe704) returned 0x0 [0105.290] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x1, wParam=0x0, lParam=0x8fe718) returned 0x0 [0105.290] GetWindow (hWnd=0x7002e, uCmd=0x3) returned 0x0 [0105.290] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe3c4 | out: lpRect=0x8fe3c4) returned 1 [0105.290] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe3c4 | out: lpRect=0x8fe3c4) returned 1 [0105.290] GetParent (hWnd=0x7002e) returned 0x8005c [0105.291] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fe3c4, cPoints=0x2 | out: lpPoints=0x8fe3c4) returned -3670050 [0105.291] SetWindowTextW (hWnd=0x7002e, lpString="CRACKED BY MAMO434376") returned 1 [0105.291] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0xc, wParam=0x0, lParam=0x27bf11c) returned 0x1 [0105.291] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x5, wParam=0x0, lParam=0x190125) returned 0x0 [0105.292] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x3, wParam=0x0, lParam=0x75008d) returned 0x0 [0105.292] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe41c | out: lpRect=0x8fe41c) returned 1 [0105.292] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe41c | out: lpRect=0x8fe41c) returned 1 [0105.292] GetParent (hWnd=0x7002e) returned 0x8005c [0105.292] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fe41c, cPoints=0x2 | out: lpPoints=0x8fe41c) returned -3670050 [0105.292] SendMessageW (hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0105.292] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x2210, wParam=0x2e0001, lParam=0x7002e) returned 0x0 [0105.292] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0105.292] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x46, wParam=0x0, lParam=0x8fe72c) returned 0x0 [0105.305] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0105.305] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x47, wParam=0x0, lParam=0x8fe72c) returned 0x0 [0105.305] GetClientRect (in: hWnd=0x7002e, lpRect=0x8fe3ec | out: lpRect=0x8fe3ec) returned 1 [0105.305] GetWindowRect (in: hWnd=0x7002e, lpRect=0x8fe3ec | out: lpRect=0x8fe3ec) returned 1 [0105.305] GetParent (hWnd=0x7002e) returned 0x8005c [0105.305] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x8005c, lpPoints=0x8fe3ec, cPoints=0x2 | out: lpPoints=0x8fe3ec) returned -3670050 [0105.305] GetParent (hWnd=0x7002e) returned 0x8005c [0105.306] GetParent (hWnd=0x7002e) returned 0x8005c [0105.306] GetParent (hWnd=0x7002e) returned 0x8005c [0105.396] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x12 [0105.396] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x12, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123", lpFilePart=0x0) returned 0x11 [0105.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed48) returned 1 [0105.397] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x8fedc4 | out: lpFileInformation=0x8fedc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed44) returned 1 [0105.398] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x12 [0105.398] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123", nBufferLength=0x12, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123", lpFilePart=0x0) returned 0x11 [0105.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fecdc) returned 1 [0105.401] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x8fed58 | out: lpFileInformation=0x8fed58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0105.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fecdc) returned 1 [0105.402] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), fInfoLevelId=0x0, lpFileInformation=0x8fed58 | out: lpFileInformation=0x8fed58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0105.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fecdc) returned 1 [0105.402] GetFileAttributesExW (in: lpFileName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x8fed58 | out: lpFileInformation=0x8fed58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0105.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0105.406] CreateDirectoryW (lpPathName="C:\\FD1HVy" (normalized: "c:\\fd1hvy"), lpSecurityAttributes=0x0) returned 1 [0105.411] CreateDirectoryW (lpPathName="C:\\FD1HVy\\Rand123" (normalized: "c:\\fd1hvy\\rand123"), lpSecurityAttributes=0x0) returned 1 [0105.415] GetCurrentProcessId () returned 0xd04 [0105.422] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x8fe6d4 | out: lpLuid=0x8fe6d4*(LowPart=0x14, HighPart=0)) returned 1 [0105.426] GetCurrentProcess () returned 0xffffffff [0105.426] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x8fe6d0 | out: TokenHandle=0x8fe6d0*=0x354) returned 1 [0105.427] AdjustTokenPrivileges (in: TokenHandle=0x354, DisableAllPrivileges=0, NewState=0x27bf6d8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0105.427] CloseHandle (hObject=0x354) returned 1 [0105.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x37994c8, Length=0x20000, ResultLength=0x8fedb8 | out: SystemInformation=0x37994c8, ResultLength=0x8fedb8*=0x235a0) returned 0xc0000004 [0105.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x37b94e8, Length=0x25da0, ResultLength=0x8fedb8 | out: SystemInformation=0x37b94e8, ResultLength=0x8fedb8*=0x19b20) returned 0x0 [0105.601] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x9d8e28 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0105.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0105.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0105.603] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123\\local.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0105.604] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\Rand123\\local.exe", nBufferLength=0x1c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\Rand123\\local.exe", lpFilePart=0x0) returned 0x1b [0105.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed60) returned 1 [0105.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe"), fInfoLevelId=0x0, lpFileInformation=0x8feddc | out: lpFileInformation=0x8feddc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78eab80, ftCreationTime.dwHighDateTime=0x1d61763, ftLastAccessTime.dwLowDateTime=0x78eab80, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x1cb40c00, ftLastWriteTime.dwHighDateTime=0x1d6175c, nFileSizeHigh=0x0, nFileSizeLow=0xe400)) returned 1 [0105.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed5c) returned 1 [0105.605] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe"), lpNewFileName="C:\\FD1HVy\\Rand123\\local.exe" (normalized: "c:\\fd1hvy\\rand123\\local.exe")) returned 1 [0105.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0105.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0105.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0105.806] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x22177fd8, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x47ad80d1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9dbe00 [0105.808] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x22177fd8, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x47ad80d1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.808] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f28ef0, ftCreationTime.dwHighDateTime=0x1d5e3ee, ftLastAccessTime.dwLowDateTime=0x5f2be670, ftLastAccessTime.dwHighDateTime=0x1d5e6fb, ftLastWriteTime.dwLowDateTime=0x5f2be670, ftLastWriteTime.dwHighDateTime=0x1d5e6fb, nFileSizeHigh=0x0, nFileSizeLow=0xf2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="-E6vb.png", cAlternateFileName="")) returned 1 [0105.809] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-YQN_4ok", cAlternateFileName="")) returned 1 [0105.809] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527fc7e0, ftCreationTime.dwHighDateTime=0x1d5ed20, ftLastAccessTime.dwLowDateTime=0x69684850, ftLastAccessTime.dwHighDateTime=0x1d5e2a9, ftLastWriteTime.dwLowDateTime=0x69684850, ftLastWriteTime.dwHighDateTime=0x1d5e2a9, nFileSizeHigh=0x0, nFileSizeLow=0x3705, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FxWXQvhHte.flv", cAlternateFileName="0FXWXQ~1.FLV")) returned 1 [0105.809] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6b39180, ftCreationTime.dwHighDateTime=0x1d5eb20, ftLastAccessTime.dwLowDateTime=0xd12b5a80, ftLastAccessTime.dwHighDateTime=0x1d5f010, ftLastWriteTime.dwLowDateTime=0xd12b5a80, ftLastWriteTime.dwHighDateTime=0x1d5f010, nFileSizeHigh=0x0, nFileSizeLow=0x14dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0n4ffGQfu yw.wav", cAlternateFileName="0N4FFG~1.WAV")) returned 1 [0105.809] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3835d140, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x64451630, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x64451630, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="4tbjYPC2CtDfATrinO.flv", cAlternateFileName="4TBJYP~1.FLV")) returned 1 [0105.809] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9fc510, ftCreationTime.dwHighDateTime=0x1d5e609, ftLastAccessTime.dwLowDateTime=0x7064acf0, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x7064acf0, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x70e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5PyHess87lIBo6JIW5aj.pps", cAlternateFileName="5PYHES~1.PPS")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde64a6a0, ftCreationTime.dwHighDateTime=0x1d5e2d4, ftLastAccessTime.dwLowDateTime=0x1b78bf40, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x1b78bf40, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x8ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Zi0ioEVH3f.jpg", cAlternateFileName="8ZI0IO~1.JPG")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf380, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc3b61c70, ftLastAccessTime.dwHighDateTime=0x1d5f08b, ftLastWriteTime.dwLowDateTime=0xc3b61c70, ftLastWriteTime.dwHighDateTime=0x1d5f08b, nFileSizeHigh=0x0, nFileSizeLow=0x623d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlFSG6N2i2xrk.mp3", cAlternateFileName="ALFSG6~1.MP3")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebd030, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xadad9e00, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0xadad9e00, ftLastWriteTime.dwHighDateTime=0x1d5e1e3, nFileSizeHigh=0x0, nFileSizeLow=0xe20f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlMEPM.mkv", cAlternateFileName="")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf33ef0, ftCreationTime.dwHighDateTime=0x1d5e463, ftLastAccessTime.dwLowDateTime=0xf9eb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xf9eb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0xab54, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOutOKzxVGxo6odR.flv", cAlternateFileName="BOUTOK~1.FLV")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x577c3040, ftCreationTime.dwHighDateTime=0x1d5e626, ftLastAccessTime.dwLowDateTime=0x133adaf0, ftLastAccessTime.dwHighDateTime=0x1d5f0ec, ftLastWriteTime.dwLowDateTime=0x133adaf0, ftLastWriteTime.dwHighDateTime=0x1d5f0ec, nFileSizeHigh=0x0, nFileSizeLow=0x8df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBErHk4e0egQ IF.mp4", cAlternateFileName="CBERHK~1.MP4")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f3e2e0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x8d2bb1f0, ftLastAccessTime.dwHighDateTime=0x1d5e344, ftLastWriteTime.dwLowDateTime=0x8d2bb1f0, ftLastWriteTime.dwHighDateTime=0x1d5e344, nFileSizeHigh=0x0, nFileSizeLow=0xac3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cnp7ZWz4-nJIM8 C.jpg", cAlternateFileName="CNP7ZW~1.JPG")) returned 1 [0105.810] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b63f30, ftCreationTime.dwHighDateTime=0x1d5ec75, ftLastAccessTime.dwLowDateTime=0x260a6b60, ftLastAccessTime.dwHighDateTime=0x1d5f073, ftLastWriteTime.dwLowDateTime=0x260a6b60, ftLastWriteTime.dwHighDateTime=0x1d5f073, nFileSizeHigh=0x0, nFileSizeLow=0xa3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cY1wsK8aC.xlsx", cAlternateFileName="CY1WSK~1.XLS")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1814bd0, ftCreationTime.dwHighDateTime=0x1d5e6ab, ftLastAccessTime.dwLowDateTime=0x4b0668b0, ftLastAccessTime.dwHighDateTime=0x1d5ef24, ftLastWriteTime.dwLowDateTime=0x4b0668b0, ftLastWriteTime.dwHighDateTime=0x1d5ef24, nFileSizeHigh=0x0, nFileSizeLow=0x1106b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFMaAmn3-uq.wav", cAlternateFileName="DFMAAM~1.WAV")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4954dd0, ftCreationTime.dwHighDateTime=0x1d5ed0d, ftLastAccessTime.dwLowDateTime=0xa2d1380, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xa2d1380, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x10af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5-Yp.wav", cAlternateFileName="")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e443c30, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0x8156e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e962, ftLastWriteTime.dwLowDateTime=0x8156e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e962, nFileSizeHigh=0x0, nFileSizeLow=0x9404, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePeV1LzXYWIIRk7D.mp3", cAlternateFileName="EPEV1L~1.MP3")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cecae0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x8959b2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x8959b2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9e4, nFileSizeHigh=0x0, nFileSizeLow=0x10c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EypBgNqV8vptqvLR.doc", cAlternateFileName="EYPBGN~1.DOC")) returned 1 [0105.811] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf7aa0, ftCreationTime.dwHighDateTime=0x1d5e0af, ftLastAccessTime.dwLowDateTime=0xbae41730, ftLastAccessTime.dwHighDateTime=0x1d5e930, ftLastWriteTime.dwLowDateTime=0xbae41730, ftLastWriteTime.dwHighDateTime=0x1d5e930, nFileSizeHigh=0x0, nFileSizeLow=0x2ee6, dwReserved0=0x0, dwReserved1=0x0, cFileName="f5bZB0iH1SGyEIL.docx", cAlternateFileName="F5BZB0~1.DOC")) returned 1 [0105.812] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c48dc0, ftCreationTime.dwHighDateTime=0x1d5e3c2, ftLastAccessTime.dwLowDateTime=0xf1d51bb0, ftLastAccessTime.dwHighDateTime=0x1d5f0e5, ftLastWriteTime.dwLowDateTime=0xf1d51bb0, ftLastWriteTime.dwHighDateTime=0x1d5f0e5, nFileSizeHigh=0x0, nFileSizeLow=0x8847, dwReserved0=0x0, dwReserved1=0x0, cFileName="FjTbbvMtAYJ 1mWqf.swf", cAlternateFileName="FJTBBV~1.SWF")) returned 1 [0105.812] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a50d0, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0x26e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d5e89e, ftLastWriteTime.dwLowDateTime=0x26e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d5e89e, nFileSizeHigh=0x0, nFileSizeLow=0x30c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhCu9i52.avi", cAlternateFileName="")) returned 1 [0105.812] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe55d7df0, ftCreationTime.dwHighDateTime=0x1d5e46f, ftLastAccessTime.dwLowDateTime=0x246ab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e306, ftLastWriteTime.dwLowDateTime=0x246ab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e306, nFileSizeHigh=0x0, nFileSizeLow=0x1700, dwReserved0=0x0, dwReserved1=0x0, cFileName="GJ-ojKY.odt", cAlternateFileName="")) returned 1 [0105.812] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe96150, ftCreationTime.dwHighDateTime=0x1d5eca9, ftLastAccessTime.dwLowDateTime=0x9f589610, ftLastAccessTime.dwHighDateTime=0x1d5e8e7, ftLastWriteTime.dwLowDateTime=0x9f589610, ftLastWriteTime.dwHighDateTime=0x1d5e8e7, nFileSizeHigh=0x0, nFileSizeLow=0x1666, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaeoIu-0Sm.flv", cAlternateFileName="IAEOIU~1.FLV")) returned 1 [0105.812] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc577ce0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0xbefeff0, ftLastAccessTime.dwHighDateTime=0x1d5eb07, ftLastWriteTime.dwLowDateTime=0xbefeff0, ftLastWriteTime.dwHighDateTime=0x1d5eb07, nFileSizeHigh=0x0, nFileSizeLow=0x9e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4W5dY_HMOXbAvF.gif", cAlternateFileName="K4W5DY~1.GIF")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe59140, ftCreationTime.dwHighDateTime=0x1d5e8ab, ftLastAccessTime.dwLowDateTime=0xf833f9f0, ftLastAccessTime.dwHighDateTime=0x1d5f030, ftLastWriteTime.dwLowDateTime=0xf833f9f0, ftLastWriteTime.dwHighDateTime=0x1d5f030, nFileSizeHigh=0x0, nFileSizeLow=0x940e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqG2EC.m4a", cAlternateFileName="")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4730cf20, ftCreationTime.dwHighDateTime=0x1d5e69e, ftLastAccessTime.dwLowDateTime=0xf8d9ba20, ftLastAccessTime.dwHighDateTime=0x1d5e97d, ftLastWriteTime.dwLowDateTime=0xf8d9ba20, ftLastWriteTime.dwHighDateTime=0x1d5e97d, nFileSizeHigh=0x0, nFileSizeLow=0xd3d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0WZNUp25FqquBgIY7M.ods", cAlternateFileName="M0WZNU~1.ODS")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198a030, ftCreationTime.dwHighDateTime=0x1d5e5ef, ftLastAccessTime.dwLowDateTime=0x44ced570, ftLastAccessTime.dwHighDateTime=0x1d5ed50, ftLastWriteTime.dwLowDateTime=0x44ced570, ftLastWriteTime.dwHighDateTime=0x1d5ed50, nFileSizeHigh=0x0, nFileSizeLow=0x14f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="m8QOvULxnziaWg.m4a", cAlternateFileName="M8QOVU~1.M4A")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8cfe60, ftCreationTime.dwHighDateTime=0x1d5e7f4, ftLastAccessTime.dwLowDateTime=0x8ca30b10, ftLastAccessTime.dwHighDateTime=0x1d5efa7, ftLastWriteTime.dwLowDateTime=0x8ca30b10, ftLastWriteTime.dwHighDateTime=0x1d5efa7, nFileSizeHigh=0x0, nFileSizeLow=0x1535f, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIF1LtAffQUPlp.doc", cAlternateFileName="NIF1LT~1.DOC")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950a300, ftCreationTime.dwHighDateTime=0x1d5f0cb, ftLastAccessTime.dwLowDateTime=0xeb420260, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xeb420260, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2qdaMi.wav", cAlternateFileName="")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec33970, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6603b4e0, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x6603b4e0, ftLastWriteTime.dwHighDateTime=0x1d5e6ac, nFileSizeHigh=0x0, nFileSizeLow=0x138fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pek24XL WXFA3n65bg6t.avi", cAlternateFileName="PEK24X~1.AVI")) returned 1 [0105.813] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1cb5ef0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xab75a600, ftLastAccessTime.dwHighDateTime=0x1d5f0a2, ftLastWriteTime.dwLowDateTime=0xab75a600, ftLastWriteTime.dwHighDateTime=0x1d5f0a2, nFileSizeHigh=0x0, nFileSizeLow=0x14d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnMfbvrh.csv", cAlternateFileName="")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae978210, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xe16ab7b0, ftLastAccessTime.dwHighDateTime=0x1d5ea48, ftLastWriteTime.dwLowDateTime=0xe16ab7b0, ftLastWriteTime.dwHighDateTime=0x1d5ea48, nFileSizeHigh=0x0, nFileSizeLow=0x1045b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqn9NZY67Cdqj.ots", cAlternateFileName="QQN9NZ~1.OTS")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4415660, ftCreationTime.dwHighDateTime=0x1d5e968, ftLastAccessTime.dwLowDateTime=0xd74b0e00, ftLastAccessTime.dwHighDateTime=0x1d5f039, ftLastWriteTime.dwLowDateTime=0xd74b0e00, ftLastWriteTime.dwHighDateTime=0x1d5f039, nFileSizeHigh=0x0, nFileSizeLow=0xa584, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCo0GuE3OXJRzFQ4kaPB.mp4", cAlternateFileName="RCO0GU~1.MP4")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8969b50, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x8b33a010, ftLastAccessTime.dwHighDateTime=0x1d5e484, ftLastWriteTime.dwLowDateTime=0x8b33a010, ftLastWriteTime.dwHighDateTime=0x1d5e484, nFileSizeHigh=0x0, nFileSizeLow=0xa113, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmj39_.m4a", cAlternateFileName="")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75aed30, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xa53e2ca0, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0xa53e2ca0, ftLastWriteTime.dwHighDateTime=0x1d5e7e5, nFileSizeHigh=0x0, nFileSizeLow=0x68d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRzHs3YOcO Su 9Qp0T.mp3", cAlternateFileName="RRZHS3~1.MP3")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc246700, ftCreationTime.dwHighDateTime=0x1d5e448, ftLastAccessTime.dwLowDateTime=0x3f2206a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x3f2206a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xf9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSYVdWFpzDU.gif", cAlternateFileName="SSYVDW~1.GIF")) returned 1 [0105.814] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9d640, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0xa7c2a910, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0xa7c2a910, ftLastWriteTime.dwHighDateTime=0x1d5ef42, nFileSizeHigh=0x0, nFileSizeLow=0x5e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhJrCn1z8KsualV3.mp4", cAlternateFileName="VHJRCN~1.MP4")) returned 1 [0105.815] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5b6340, ftCreationTime.dwHighDateTime=0x1d5e819, ftLastAccessTime.dwLowDateTime=0x9aefc950, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x9aefc950, ftLastWriteTime.dwHighDateTime=0x1d5e819, nFileSizeHigh=0x0, nFileSizeLow=0x5181, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOuJrZJUPXMR_VcGq.mp3", cAlternateFileName="VOUJRZ~1.MP3")) returned 1 [0105.815] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5e70, ftCreationTime.dwHighDateTime=0x1d5ef2b, ftLastAccessTime.dwLowDateTime=0x28e54490, ftLastAccessTime.dwHighDateTime=0x1d5e22c, ftLastWriteTime.dwLowDateTime=0x28e54490, ftLastWriteTime.dwHighDateTime=0x1d5e22c, nFileSizeHigh=0x0, nFileSizeLow=0xa207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VwGo72iqw.wav", cAlternateFileName="VWGO72~1.WAV")) returned 1 [0105.815] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df682d0, ftCreationTime.dwHighDateTime=0x1d5ec6f, ftLastAccessTime.dwLowDateTime=0x8925ac00, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x8925ac00, ftLastWriteTime.dwHighDateTime=0x1d5e713, nFileSizeHigh=0x0, nFileSizeLow=0x100f, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUH_OX1ZBfpq-NsE.avi", cAlternateFileName="WUH_OX~1.AVI")) returned 1 [0105.815] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1774a980, ftCreationTime.dwHighDateTime=0x1d5e998, ftLastAccessTime.dwLowDateTime=0x8a322330, ftLastAccessTime.dwHighDateTime=0x1d5e5c4, ftLastWriteTime.dwLowDateTime=0x8a322330, ftLastWriteTime.dwHighDateTime=0x1d5e5c4, nFileSizeHigh=0x0, nFileSizeLow=0x15b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCczzh.mp3", cAlternateFileName="")) returned 1 [0105.815] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64928df0, ftCreationTime.dwHighDateTime=0x1d5eb68, ftLastAccessTime.dwLowDateTime=0x6e264a30, ftLastAccessTime.dwHighDateTime=0x1d5e228, ftLastWriteTime.dwLowDateTime=0x6e264a30, ftLastWriteTime.dwHighDateTime=0x1d5e228, nFileSizeHigh=0x0, nFileSizeLow=0xfe6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yq2iBy OgmaKpzop.gif", cAlternateFileName="YQ2IBY~1.GIF")) returned 1 [0105.821] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123678f0, ftCreationTime.dwHighDateTime=0x1d5e799, ftLastAccessTime.dwLowDateTime=0xd64d0950, ftLastAccessTime.dwHighDateTime=0x1d5f015, ftLastWriteTime.dwLowDateTime=0xd64d0950, ftLastWriteTime.dwHighDateTime=0x1d5f015, nFileSizeHigh=0x0, nFileSizeLow=0x1318e, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7J0cG9uHbZs.mp4", cAlternateFileName="Z7J0CG~1.MP4")) returned 1 [0105.821] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 1 [0105.821] FindNextFileW (in: hFindFile=0x9dbe00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0105.821] FindClose (in: hFindFile=0x9dbe00 | out: hFindFile=0x9dbe00) returned 1 [0105.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0105.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0105.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0105.822] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0105.822] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0105.822] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x47ad80d1, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x47ad80d1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9dbf00 [0105.823] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x47ad80d1, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x47ad80d1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.823] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f28ef0, ftCreationTime.dwHighDateTime=0x1d5e3ee, ftLastAccessTime.dwLowDateTime=0x5f2be670, ftLastAccessTime.dwHighDateTime=0x1d5e6fb, ftLastWriteTime.dwLowDateTime=0x5f2be670, ftLastWriteTime.dwHighDateTime=0x1d5e6fb, nFileSizeHigh=0x0, nFileSizeLow=0xf2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="-E6vb.png", cAlternateFileName="")) returned 1 [0105.824] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-YQN_4ok", cAlternateFileName="")) returned 1 [0105.824] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527fc7e0, ftCreationTime.dwHighDateTime=0x1d5ed20, ftLastAccessTime.dwLowDateTime=0x69684850, ftLastAccessTime.dwHighDateTime=0x1d5e2a9, ftLastWriteTime.dwLowDateTime=0x69684850, ftLastWriteTime.dwHighDateTime=0x1d5e2a9, nFileSizeHigh=0x0, nFileSizeLow=0x3705, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FxWXQvhHte.flv", cAlternateFileName="0FXWXQ~1.FLV")) returned 1 [0105.824] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6b39180, ftCreationTime.dwHighDateTime=0x1d5eb20, ftLastAccessTime.dwLowDateTime=0xd12b5a80, ftLastAccessTime.dwHighDateTime=0x1d5f010, ftLastWriteTime.dwLowDateTime=0xd12b5a80, ftLastWriteTime.dwHighDateTime=0x1d5f010, nFileSizeHigh=0x0, nFileSizeLow=0x14dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0n4ffGQfu yw.wav", cAlternateFileName="0N4FFG~1.WAV")) returned 1 [0105.824] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3835d140, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x64451630, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x64451630, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="4tbjYPC2CtDfATrinO.flv", cAlternateFileName="4TBJYP~1.FLV")) returned 1 [0105.824] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9fc510, ftCreationTime.dwHighDateTime=0x1d5e609, ftLastAccessTime.dwLowDateTime=0x7064acf0, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x7064acf0, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x70e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5PyHess87lIBo6JIW5aj.pps", cAlternateFileName="5PYHES~1.PPS")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde64a6a0, ftCreationTime.dwHighDateTime=0x1d5e2d4, ftLastAccessTime.dwLowDateTime=0x1b78bf40, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x1b78bf40, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x8ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Zi0ioEVH3f.jpg", cAlternateFileName="8ZI0IO~1.JPG")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf380, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc3b61c70, ftLastAccessTime.dwHighDateTime=0x1d5f08b, ftLastWriteTime.dwLowDateTime=0xc3b61c70, ftLastWriteTime.dwHighDateTime=0x1d5f08b, nFileSizeHigh=0x0, nFileSizeLow=0x623d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlFSG6N2i2xrk.mp3", cAlternateFileName="ALFSG6~1.MP3")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebd030, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xadad9e00, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0xadad9e00, ftLastWriteTime.dwHighDateTime=0x1d5e1e3, nFileSizeHigh=0x0, nFileSizeLow=0xe20f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlMEPM.mkv", cAlternateFileName="")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf33ef0, ftCreationTime.dwHighDateTime=0x1d5e463, ftLastAccessTime.dwLowDateTime=0xf9eb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xf9eb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0xab54, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOutOKzxVGxo6odR.flv", cAlternateFileName="BOUTOK~1.FLV")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x577c3040, ftCreationTime.dwHighDateTime=0x1d5e626, ftLastAccessTime.dwLowDateTime=0x133adaf0, ftLastAccessTime.dwHighDateTime=0x1d5f0ec, ftLastWriteTime.dwLowDateTime=0x133adaf0, ftLastWriteTime.dwHighDateTime=0x1d5f0ec, nFileSizeHigh=0x0, nFileSizeLow=0x8df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBErHk4e0egQ IF.mp4", cAlternateFileName="CBERHK~1.MP4")) returned 1 [0105.825] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f3e2e0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x8d2bb1f0, ftLastAccessTime.dwHighDateTime=0x1d5e344, ftLastWriteTime.dwLowDateTime=0x8d2bb1f0, ftLastWriteTime.dwHighDateTime=0x1d5e344, nFileSizeHigh=0x0, nFileSizeLow=0xac3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cnp7ZWz4-nJIM8 C.jpg", cAlternateFileName="CNP7ZW~1.JPG")) returned 1 [0105.826] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b63f30, ftCreationTime.dwHighDateTime=0x1d5ec75, ftLastAccessTime.dwLowDateTime=0x260a6b60, ftLastAccessTime.dwHighDateTime=0x1d5f073, ftLastWriteTime.dwLowDateTime=0x260a6b60, ftLastWriteTime.dwHighDateTime=0x1d5f073, nFileSizeHigh=0x0, nFileSizeLow=0xa3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cY1wsK8aC.xlsx", cAlternateFileName="CY1WSK~1.XLS")) returned 1 [0105.826] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0105.826] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1814bd0, ftCreationTime.dwHighDateTime=0x1d5e6ab, ftLastAccessTime.dwLowDateTime=0x4b0668b0, ftLastAccessTime.dwHighDateTime=0x1d5ef24, ftLastWriteTime.dwLowDateTime=0x4b0668b0, ftLastWriteTime.dwHighDateTime=0x1d5ef24, nFileSizeHigh=0x0, nFileSizeLow=0x1106b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFMaAmn3-uq.wav", cAlternateFileName="DFMAAM~1.WAV")) returned 1 [0105.826] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4954dd0, ftCreationTime.dwHighDateTime=0x1d5ed0d, ftLastAccessTime.dwLowDateTime=0xa2d1380, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xa2d1380, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x10af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5-Yp.wav", cAlternateFileName="")) returned 1 [0105.826] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e443c30, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0x8156e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e962, ftLastWriteTime.dwLowDateTime=0x8156e4c0, ftLastWriteTime.dwHighDateTime=0x1d5e962, nFileSizeHigh=0x0, nFileSizeLow=0x9404, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePeV1LzXYWIIRk7D.mp3", cAlternateFileName="EPEV1L~1.MP3")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cecae0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x8959b2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x8959b2b0, ftLastWriteTime.dwHighDateTime=0x1d5e9e4, nFileSizeHigh=0x0, nFileSizeLow=0x10c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="EypBgNqV8vptqvLR.doc", cAlternateFileName="EYPBGN~1.DOC")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf7aa0, ftCreationTime.dwHighDateTime=0x1d5e0af, ftLastAccessTime.dwLowDateTime=0xbae41730, ftLastAccessTime.dwHighDateTime=0x1d5e930, ftLastWriteTime.dwLowDateTime=0xbae41730, ftLastWriteTime.dwHighDateTime=0x1d5e930, nFileSizeHigh=0x0, nFileSizeLow=0x2ee6, dwReserved0=0x0, dwReserved1=0x0, cFileName="f5bZB0iH1SGyEIL.docx", cAlternateFileName="F5BZB0~1.DOC")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c48dc0, ftCreationTime.dwHighDateTime=0x1d5e3c2, ftLastAccessTime.dwLowDateTime=0xf1d51bb0, ftLastAccessTime.dwHighDateTime=0x1d5f0e5, ftLastWriteTime.dwLowDateTime=0xf1d51bb0, ftLastWriteTime.dwHighDateTime=0x1d5f0e5, nFileSizeHigh=0x0, nFileSizeLow=0x8847, dwReserved0=0x0, dwReserved1=0x0, cFileName="FjTbbvMtAYJ 1mWqf.swf", cAlternateFileName="FJTBBV~1.SWF")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a50d0, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0x26e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d5e89e, ftLastWriteTime.dwLowDateTime=0x26e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d5e89e, nFileSizeHigh=0x0, nFileSizeLow=0x30c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhCu9i52.avi", cAlternateFileName="")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe55d7df0, ftCreationTime.dwHighDateTime=0x1d5e46f, ftLastAccessTime.dwLowDateTime=0x246ab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e306, ftLastWriteTime.dwLowDateTime=0x246ab6e0, ftLastWriteTime.dwHighDateTime=0x1d5e306, nFileSizeHigh=0x0, nFileSizeLow=0x1700, dwReserved0=0x0, dwReserved1=0x0, cFileName="GJ-ojKY.odt", cAlternateFileName="")) returned 1 [0105.827] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe96150, ftCreationTime.dwHighDateTime=0x1d5eca9, ftLastAccessTime.dwLowDateTime=0x9f589610, ftLastAccessTime.dwHighDateTime=0x1d5e8e7, ftLastWriteTime.dwLowDateTime=0x9f589610, ftLastWriteTime.dwHighDateTime=0x1d5e8e7, nFileSizeHigh=0x0, nFileSizeLow=0x1666, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaeoIu-0Sm.flv", cAlternateFileName="IAEOIU~1.FLV")) returned 1 [0105.828] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc577ce0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0xbefeff0, ftLastAccessTime.dwHighDateTime=0x1d5eb07, ftLastWriteTime.dwLowDateTime=0xbefeff0, ftLastWriteTime.dwHighDateTime=0x1d5eb07, nFileSizeHigh=0x0, nFileSizeLow=0x9e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4W5dY_HMOXbAvF.gif", cAlternateFileName="K4W5DY~1.GIF")) returned 1 [0105.828] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe59140, ftCreationTime.dwHighDateTime=0x1d5e8ab, ftLastAccessTime.dwLowDateTime=0xf833f9f0, ftLastAccessTime.dwHighDateTime=0x1d5f030, ftLastWriteTime.dwLowDateTime=0xf833f9f0, ftLastWriteTime.dwHighDateTime=0x1d5f030, nFileSizeHigh=0x0, nFileSizeLow=0x940e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqG2EC.m4a", cAlternateFileName="")) returned 1 [0105.828] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4730cf20, ftCreationTime.dwHighDateTime=0x1d5e69e, ftLastAccessTime.dwLowDateTime=0xf8d9ba20, ftLastAccessTime.dwHighDateTime=0x1d5e97d, ftLastWriteTime.dwLowDateTime=0xf8d9ba20, ftLastWriteTime.dwHighDateTime=0x1d5e97d, nFileSizeHigh=0x0, nFileSizeLow=0xd3d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0WZNUp25FqquBgIY7M.ods", cAlternateFileName="M0WZNU~1.ODS")) returned 1 [0105.828] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198a030, ftCreationTime.dwHighDateTime=0x1d5e5ef, ftLastAccessTime.dwLowDateTime=0x44ced570, ftLastAccessTime.dwHighDateTime=0x1d5ed50, ftLastWriteTime.dwLowDateTime=0x44ced570, ftLastWriteTime.dwHighDateTime=0x1d5ed50, nFileSizeHigh=0x0, nFileSizeLow=0x14f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="m8QOvULxnziaWg.m4a", cAlternateFileName="M8QOVU~1.M4A")) returned 1 [0105.828] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8cfe60, ftCreationTime.dwHighDateTime=0x1d5e7f4, ftLastAccessTime.dwLowDateTime=0x8ca30b10, ftLastAccessTime.dwHighDateTime=0x1d5efa7, ftLastWriteTime.dwLowDateTime=0x8ca30b10, ftLastWriteTime.dwHighDateTime=0x1d5efa7, nFileSizeHigh=0x0, nFileSizeLow=0x1535f, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIF1LtAffQUPlp.doc", cAlternateFileName="NIF1LT~1.DOC")) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950a300, ftCreationTime.dwHighDateTime=0x1d5f0cb, ftLastAccessTime.dwLowDateTime=0xeb420260, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xeb420260, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2qdaMi.wav", cAlternateFileName="")) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec33970, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6603b4e0, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x6603b4e0, ftLastWriteTime.dwHighDateTime=0x1d5e6ac, nFileSizeHigh=0x0, nFileSizeLow=0x138fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pek24XL WXFA3n65bg6t.avi", cAlternateFileName="PEK24X~1.AVI")) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1cb5ef0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xab75a600, ftLastAccessTime.dwHighDateTime=0x1d5f0a2, ftLastWriteTime.dwLowDateTime=0xab75a600, ftLastWriteTime.dwHighDateTime=0x1d5f0a2, nFileSizeHigh=0x0, nFileSizeLow=0x14d2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnMfbvrh.csv", cAlternateFileName="")) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae978210, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xe16ab7b0, ftLastAccessTime.dwHighDateTime=0x1d5ea48, ftLastWriteTime.dwLowDateTime=0xe16ab7b0, ftLastWriteTime.dwHighDateTime=0x1d5ea48, nFileSizeHigh=0x0, nFileSizeLow=0x1045b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqn9NZY67Cdqj.ots", cAlternateFileName="QQN9NZ~1.OTS")) returned 1 [0105.829] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4415660, ftCreationTime.dwHighDateTime=0x1d5e968, ftLastAccessTime.dwLowDateTime=0xd74b0e00, ftLastAccessTime.dwHighDateTime=0x1d5f039, ftLastWriteTime.dwLowDateTime=0xd74b0e00, ftLastWriteTime.dwHighDateTime=0x1d5f039, nFileSizeHigh=0x0, nFileSizeLow=0xa584, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCo0GuE3OXJRzFQ4kaPB.mp4", cAlternateFileName="RCO0GU~1.MP4")) returned 1 [0105.830] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8969b50, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x8b33a010, ftLastAccessTime.dwHighDateTime=0x1d5e484, ftLastWriteTime.dwLowDateTime=0x8b33a010, ftLastWriteTime.dwHighDateTime=0x1d5e484, nFileSizeHigh=0x0, nFileSizeLow=0xa113, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmj39_.m4a", cAlternateFileName="")) returned 1 [0105.830] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75aed30, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xa53e2ca0, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0xa53e2ca0, ftLastWriteTime.dwHighDateTime=0x1d5e7e5, nFileSizeHigh=0x0, nFileSizeLow=0x68d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRzHs3YOcO Su 9Qp0T.mp3", cAlternateFileName="RRZHS3~1.MP3")) returned 1 [0105.830] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc246700, ftCreationTime.dwHighDateTime=0x1d5e448, ftLastAccessTime.dwLowDateTime=0x3f2206a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x3f2206a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xf9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSYVdWFpzDU.gif", cAlternateFileName="SSYVDW~1.GIF")) returned 1 [0105.830] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9d640, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0xa7c2a910, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0xa7c2a910, ftLastWriteTime.dwHighDateTime=0x1d5ef42, nFileSizeHigh=0x0, nFileSizeLow=0x5e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhJrCn1z8KsualV3.mp4", cAlternateFileName="VHJRCN~1.MP4")) returned 1 [0105.830] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5b6340, ftCreationTime.dwHighDateTime=0x1d5e819, ftLastAccessTime.dwLowDateTime=0x9aefc950, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x9aefc950, ftLastWriteTime.dwHighDateTime=0x1d5e819, nFileSizeHigh=0x0, nFileSizeLow=0x5181, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOuJrZJUPXMR_VcGq.mp3", cAlternateFileName="VOUJRZ~1.MP3")) returned 1 [0105.831] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5e70, ftCreationTime.dwHighDateTime=0x1d5ef2b, ftLastAccessTime.dwLowDateTime=0x28e54490, ftLastAccessTime.dwHighDateTime=0x1d5e22c, ftLastWriteTime.dwLowDateTime=0x28e54490, ftLastWriteTime.dwHighDateTime=0x1d5e22c, nFileSizeHigh=0x0, nFileSizeLow=0xa207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VwGo72iqw.wav", cAlternateFileName="VWGO72~1.WAV")) returned 1 [0105.831] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df682d0, ftCreationTime.dwHighDateTime=0x1d5ec6f, ftLastAccessTime.dwLowDateTime=0x8925ac00, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x8925ac00, ftLastWriteTime.dwHighDateTime=0x1d5e713, nFileSizeHigh=0x0, nFileSizeLow=0x100f, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUH_OX1ZBfpq-NsE.avi", cAlternateFileName="WUH_OX~1.AVI")) returned 1 [0105.831] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1774a980, ftCreationTime.dwHighDateTime=0x1d5e998, ftLastAccessTime.dwLowDateTime=0x8a322330, ftLastAccessTime.dwHighDateTime=0x1d5e5c4, ftLastWriteTime.dwLowDateTime=0x8a322330, ftLastWriteTime.dwHighDateTime=0x1d5e5c4, nFileSizeHigh=0x0, nFileSizeLow=0x15b39, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCczzh.mp3", cAlternateFileName="")) returned 1 [0105.882] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64928df0, ftCreationTime.dwHighDateTime=0x1d5eb68, ftLastAccessTime.dwLowDateTime=0x6e264a30, ftLastAccessTime.dwHighDateTime=0x1d5e228, ftLastWriteTime.dwLowDateTime=0x6e264a30, ftLastWriteTime.dwHighDateTime=0x1d5e228, nFileSizeHigh=0x0, nFileSizeLow=0xfe6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yq2iBy OgmaKpzop.gif", cAlternateFileName="YQ2IBY~1.GIF")) returned 1 [0105.882] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123678f0, ftCreationTime.dwHighDateTime=0x1d5e799, ftLastAccessTime.dwLowDateTime=0xd64d0950, ftLastAccessTime.dwHighDateTime=0x1d5f015, ftLastWriteTime.dwLowDateTime=0xd64d0950, ftLastWriteTime.dwHighDateTime=0x1d5f015, nFileSizeHigh=0x0, nFileSizeLow=0x1318e, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7J0cG9uHbZs.mp4", cAlternateFileName="Z7J0CG~1.MP4")) returned 1 [0105.883] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 1 [0105.883] FindNextFileW (in: hFindFile=0x9dbf00, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 0 [0105.883] FindClose (in: hFindFile=0x9dbf00 | out: hFindFile=0x9dbf00) returned 1 [0105.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0105.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0105.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0105.900] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", lpFilePart=0x0) returned 0x21 [0105.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0105.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\-e6vb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0105.900] GetFileType (hFile=0x354) returned 0x1 [0105.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0105.900] GetFileType (hFile=0x354) returned 0x1 [0105.900] GetFileSize (in: hFile=0x354, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xf2a1 [0105.902] ReadFile (in: hFile=0x354, lpBuffer=0x27ef6b8, nNumberOfBytesToRead=0xf2a1, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x27ef6b8*, lpNumberOfBytesRead=0x8fec60*=0xf2a1, lpOverlapped=0x0) returned 1 [0105.902] CloseHandle (hObject=0x354) returned 1 [0114.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0114.523] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0114.524] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0114.524] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0114.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb20) returned 1 [0114.525] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x8feb9c | out: lpFileInformation=0x8feb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0114.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb1c) returned 1 [0114.983] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x8fea78 | out: pfEnabled=0x8fea78) returned 0x0 [0115.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0115.677] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0115.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0115.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0115.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0115.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0115.678] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", lpFilePart=0x0) returned 0x21 [0115.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0115.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\-e6vb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0115.681] GetFileType (hFile=0x40c) returned 0x1 [0115.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0115.681] GetFileType (hFile=0x40c) returned 0x1 [0115.683] WriteFile (in: hFile=0x40c, lpBuffer=0x2893fc8*, nNumberOfBytesToWrite=0xf2b0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2893fc8*, lpNumberOfBytesWritten=0x8fec54*=0xf2b0, lpOverlapped=0x0) returned 1 [0115.686] CloseHandle (hObject=0x40c) returned 1 [0115.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0115.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png", lpFilePart=0x0) returned 0x21 [0115.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0115.786] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png.rogue", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png.rogue", lpFilePart=0x0) returned 0x27 [0115.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0115.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\-e6vb.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f28ef0, ftCreationTime.dwHighDateTime=0x1d5e3ee, ftLastAccessTime.dwLowDateTime=0x5f2be670, ftLastAccessTime.dwHighDateTime=0x1d5e6fb, ftLastWriteTime.dwLowDateTime=0x4db892ad, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xf2b0)) returned 1 [0115.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0115.786] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png" (normalized: "c:\\users\\fd1hvy\\desktop\\-e6vb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-E6vb.png.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-e6vb.png.rogue")) returned 1 [0115.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0115.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", lpFilePart=0x0) returned 0x27 [0115.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0115.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\8zi0ioevh3f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0115.847] GetFileType (hFile=0x40c) returned 0x1 [0115.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0115.847] GetFileType (hFile=0x40c) returned 0x1 [0115.847] GetFileSize (in: hFile=0x40c, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x8ad7 [0115.848] ReadFile (in: hFile=0x40c, lpBuffer=0x28a351c, nNumberOfBytesToRead=0x8ad7, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28a351c*, lpNumberOfBytesRead=0x8fec60*=0x8ad7, lpOverlapped=0x0) returned 1 [0115.848] CloseHandle (hObject=0x40c) returned 1 [0116.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0116.067] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0116.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0116.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0116.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.068] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", lpFilePart=0x0) returned 0x27 [0116.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0116.068] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\8zi0ioevh3f.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0116.120] GetFileType (hFile=0x40c) returned 0x1 [0116.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0116.120] GetFileType (hFile=0x40c) returned 0x1 [0116.120] WriteFile (in: hFile=0x40c, lpBuffer=0x291b968*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x291b968*, lpNumberOfBytesWritten=0x8fec54*=0x8ae0, lpOverlapped=0x0) returned 1 [0116.122] CloseHandle (hObject=0x40c) returned 1 [0116.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0116.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg", lpFilePart=0x0) returned 0x27 [0116.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0116.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg.rogue", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg.rogue", lpFilePart=0x0) returned 0x2d [0116.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0116.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\8zi0ioevh3f.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde64a6a0, ftCreationTime.dwHighDateTime=0x1d5e2d4, ftLastAccessTime.dwLowDateTime=0x1b78bf40, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x4df519c0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0)) returned 1 [0116.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0116.189] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\8zi0ioevh3f.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\8Zi0ioEVH3f.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\8zi0ioevh3f.jpg.rogue")) returned 1 [0116.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0116.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", lpFilePart=0x0) returned 0x29 [0116.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0116.258] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\alfsg6n2i2xrk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0116.258] GetFileType (hFile=0x40c) returned 0x1 [0116.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0116.259] GetFileType (hFile=0x40c) returned 0x1 [0116.259] GetFileSize (in: hFile=0x40c, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x623d [0116.259] ReadFile (in: hFile=0x40c, lpBuffer=0x29246a8, nNumberOfBytesToRead=0x623d, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29246a8*, lpNumberOfBytesRead=0x8fec60*=0x623d, lpOverlapped=0x0) returned 1 [0116.261] CloseHandle (hObject=0x40c) returned 1 [0116.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0116.680] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0116.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0116.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0116.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0116.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0116.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", lpFilePart=0x0) returned 0x29 [0116.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0116.681] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\alfsg6n2i2xrk.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0116.867] GetFileType (hFile=0x40c) returned 0x1 [0116.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0116.867] GetFileType (hFile=0x40c) returned 0x1 [0116.867] WriteFile (in: hFile=0x40c, lpBuffer=0x298ffd4*, nNumberOfBytesToWrite=0x6240, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x298ffd4*, lpNumberOfBytesWritten=0x8fec54*=0x6240, lpOverlapped=0x0) returned 1 [0116.869] CloseHandle (hObject=0x40c) returned 1 [0116.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0116.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3", lpFilePart=0x0) returned 0x29 [0116.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0116.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3.rogue", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3.rogue", lpFilePart=0x0) returned 0x2f [0116.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0116.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\alfsg6n2i2xrk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf380, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc3b61c70, ftLastAccessTime.dwHighDateTime=0x1d5f08b, ftLastWriteTime.dwLowDateTime=0x4e643c8d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x6240)) returned 1 [0116.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0116.928] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\alfsg6n2i2xrk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\AlFSG6N2i2xrk.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\alfsg6n2i2xrk.mp3.rogue")) returned 1 [0117.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0117.104] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", lpFilePart=0x0) returned 0x22 [0117.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0117.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\almepm.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x40c [0117.105] GetFileType (hFile=0x40c) returned 0x1 [0117.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0117.105] GetFileType (hFile=0x40c) returned 0x1 [0117.105] GetFileSize (in: hFile=0x40c, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xe20f [0117.116] ReadFile (in: hFile=0x40c, lpBuffer=0x27bc8a8, nNumberOfBytesToRead=0xe20f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x27bc8a8*, lpNumberOfBytesRead=0x8fec60*=0xe20f, lpOverlapped=0x0) returned 1 [0117.117] CloseHandle (hObject=0x40c) returned 1 [0117.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0117.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0117.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0117.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0117.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0117.342] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", lpFilePart=0x0) returned 0x22 [0117.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0117.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\almepm.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.345] GetFileType (hFile=0x2e0) returned 0x1 [0117.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0117.345] GetFileType (hFile=0x2e0) returned 0x1 [0117.345] WriteFile (in: hFile=0x2e0, lpBuffer=0x2833e34*, nNumberOfBytesToWrite=0xe210, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2833e34*, lpNumberOfBytesWritten=0x8fec54*=0xe210, lpOverlapped=0x0) returned 1 [0117.348] CloseHandle (hObject=0x2e0) returned 1 [0117.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0117.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv", lpFilePart=0x0) returned 0x22 [0117.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0117.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv.rogue", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv.rogue", lpFilePart=0x0) returned 0x28 [0117.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0117.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\almepm.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebd030, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xadad9e00, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0x4eae25a0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xe210)) returned 1 [0117.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0117.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\almepm.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\AlMEPM.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\almepm.mkv.rogue")) returned 1 [0117.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0117.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", lpFilePart=0x0) returned 0x2b [0117.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0117.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cberhk4e0egq if.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.353] GetFileType (hFile=0x2e0) returned 0x1 [0117.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0117.353] GetFileType (hFile=0x2e0) returned 0x1 [0117.353] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x8df7 [0117.353] ReadFile (in: hFile=0x2e0, lpBuffer=0x28422b0, nNumberOfBytesToRead=0x8df7, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28422b0*, lpNumberOfBytesRead=0x8fec60*=0x8df7, lpOverlapped=0x0) returned 1 [0117.354] CloseHandle (hObject=0x2e0) returned 1 [0117.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0117.544] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0117.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0117.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0117.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0117.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", lpFilePart=0x0) returned 0x2b [0117.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0117.545] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cberhk4e0egq if.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.546] GetFileType (hFile=0x2e0) returned 0x1 [0117.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0117.546] GetFileType (hFile=0x2e0) returned 0x1 [0117.547] WriteFile (in: hFile=0x2e0, lpBuffer=0x28bb69c*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28bb69c*, lpNumberOfBytesWritten=0x8fec54*=0x8e00, lpOverlapped=0x0) returned 1 [0117.548] CloseHandle (hObject=0x2e0) returned 1 [0117.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0117.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4", lpFilePart=0x0) returned 0x2b [0117.552] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0117.553] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4.rogue", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4.rogue", lpFilePart=0x0) returned 0x31 [0117.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0117.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cberhk4e0egq if.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x577c3040, ftCreationTime.dwHighDateTime=0x1d5e626, ftLastAccessTime.dwLowDateTime=0x133adaf0, ftLastAccessTime.dwHighDateTime=0x1d5f0ec, ftLastWriteTime.dwLowDateTime=0x4ecd23c6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8e00)) returned 1 [0117.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0117.553] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\cberhk4e0egq if.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cBErHk4e0egQ IF.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\cberhk4e0egq if.mp4.rogue")) returned 1 [0117.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0117.554] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", lpFilePart=0x0) returned 0x2c [0117.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0117.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cnp7zwz4-njim8 c.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.554] GetFileType (hFile=0x2e0) returned 0x1 [0117.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0117.554] GetFileType (hFile=0x2e0) returned 0x1 [0117.554] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xac3c [0117.554] ReadFile (in: hFile=0x2e0, lpBuffer=0x28c4714, nNumberOfBytesToRead=0xac3c, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28c4714*, lpNumberOfBytesRead=0x8fec60*=0xac3c, lpOverlapped=0x0) returned 1 [0117.555] CloseHandle (hObject=0x2e0) returned 1 [0117.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0117.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0117.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0117.789] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0117.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0117.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", lpFilePart=0x0) returned 0x2c [0117.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0117.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cnp7zwz4-njim8 c.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.790] GetFileType (hFile=0x2e0) returned 0x1 [0117.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0117.790] GetFileType (hFile=0x2e0) returned 0x1 [0117.790] WriteFile (in: hFile=0x2e0, lpBuffer=0x29319d0*, nNumberOfBytesToWrite=0xac40, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29319d0*, lpNumberOfBytesWritten=0x8fec54*=0xac40, lpOverlapped=0x0) returned 1 [0117.792] CloseHandle (hObject=0x2e0) returned 1 [0117.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0117.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg", lpFilePart=0x0) returned 0x2c [0117.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0117.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg.rogue", lpFilePart=0x0) returned 0x32 [0117.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0117.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cnp7zwz4-njim8 c.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f3e2e0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x8d2bb1f0, ftLastAccessTime.dwHighDateTime=0x1d5e344, ftLastWriteTime.dwLowDateTime=0x4ef0e617, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xac40)) returned 1 [0117.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0117.795] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\cnp7zwz4-njim8 c.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Cnp7ZWz4-nJIM8 C.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\cnp7zwz4-njim8 c.jpg.rogue")) returned 1 [0117.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0117.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", lpFilePart=0x0) returned 0x26 [0117.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0117.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\cy1wsk8ac.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.797] GetFileType (hFile=0x2e0) returned 0x1 [0117.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0117.797] GetFileType (hFile=0x2e0) returned 0x1 [0117.797] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xa3a8 [0117.797] ReadFile (in: hFile=0x2e0, lpBuffer=0x293c884, nNumberOfBytesToRead=0xa3a8, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x293c884*, lpNumberOfBytesRead=0x8fec60*=0xa3a8, lpOverlapped=0x0) returned 1 [0117.797] CloseHandle (hObject=0x2e0) returned 1 [0117.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0117.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0117.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0117.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0117.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0117.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0117.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", lpFilePart=0x0) returned 0x26 [0117.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0117.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\cy1wsk8ac.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.878] GetFileType (hFile=0x2e0) returned 0x1 [0117.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0117.878] GetFileType (hFile=0x2e0) returned 0x1 [0117.878] WriteFile (in: hFile=0x2e0, lpBuffer=0x29bc8dc*, nNumberOfBytesToWrite=0xa3b0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29bc8dc*, lpNumberOfBytesWritten=0x8fec54*=0xa3b0, lpOverlapped=0x0) returned 1 [0117.880] CloseHandle (hObject=0x2e0) returned 1 [0117.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0117.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx", lpFilePart=0x0) returned 0x26 [0117.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0117.882] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx.rogue", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx.rogue", lpFilePart=0x0) returned 0x2c [0117.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0117.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\cy1wsk8ac.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b63f30, ftCreationTime.dwHighDateTime=0x1d5ec75, ftLastAccessTime.dwLowDateTime=0x260a6b60, ftLastAccessTime.dwHighDateTime=0x1d5f073, ftLastWriteTime.dwLowDateTime=0x4eff34f9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa3b0)) returned 1 [0117.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0117.882] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\cy1wsk8ac.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\cY1wsK8aC.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\cy1wsk8ac.xlsx.rogue")) returned 1 [0117.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0117.883] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", lpFilePart=0x0) returned 0x2c [0117.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0117.883] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\epev1lzxywiirk7d.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0117.884] GetFileType (hFile=0x2e0) returned 0x1 [0117.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0117.884] GetFileType (hFile=0x2e0) returned 0x1 [0117.884] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x9404 [0117.885] ReadFile (in: hFile=0x2e0, lpBuffer=0x29c6f3c, nNumberOfBytesToRead=0x9404, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29c6f3c*, lpNumberOfBytesRead=0x8fec60*=0x9404, lpOverlapped=0x0) returned 1 [0117.885] CloseHandle (hObject=0x2e0) returned 1 [0118.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0118.031] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0118.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0118.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0118.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0118.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", lpFilePart=0x0) returned 0x2c [0118.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0118.032] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\epev1lzxywiirk7d.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.034] GetFileType (hFile=0x2e0) returned 0x1 [0118.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0118.034] GetFileType (hFile=0x2e0) returned 0x1 [0118.034] WriteFile (in: hFile=0x2e0, lpBuffer=0x2a42174*, nNumberOfBytesToWrite=0x9410, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2a42174*, lpNumberOfBytesWritten=0x8fec54*=0x9410, lpOverlapped=0x0) returned 1 [0118.037] CloseHandle (hObject=0x2e0) returned 1 [0118.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3", lpFilePart=0x0) returned 0x2c [0118.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0118.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3.rogue", lpFilePart=0x0) returned 0x32 [0118.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0118.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\epev1lzxywiirk7d.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e443c30, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0x8156e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e962, ftLastWriteTime.dwLowDateTime=0x4f170cf6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9410)) returned 1 [0118.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0118.039] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\epev1lzxywiirk7d.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ePeV1LzXYWIIRk7D.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\epev1lzxywiirk7d.mp3.rogue")) returned 1 [0118.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.041] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", lpFilePart=0x0) returned 0x2c [0118.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0118.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\eypbgnqv8vptqvlr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.041] GetFileType (hFile=0x2e0) returned 0x1 [0118.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0118.041] GetFileType (hFile=0x2e0) returned 0x1 [0118.041] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x10c5 [0118.041] ReadFile (in: hFile=0x2e0, lpBuffer=0x2a4b804, nNumberOfBytesToRead=0x10c5, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2a4b804*, lpNumberOfBytesRead=0x8fec60*=0x10c5, lpOverlapped=0x0) returned 1 [0118.042] CloseHandle (hObject=0x2e0) returned 1 [0118.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0118.206] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0118.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0118.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0118.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0118.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.207] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", lpFilePart=0x0) returned 0x2c [0118.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0118.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\eypbgnqv8vptqvlr.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.208] GetFileType (hFile=0x2e0) returned 0x1 [0118.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0118.208] GetFileType (hFile=0x2e0) returned 0x1 [0118.208] WriteFile (in: hFile=0x2e0, lpBuffer=0x2a9da00*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2a9da00*, lpNumberOfBytesWritten=0x8fec54*=0x10d0, lpOverlapped=0x0) returned 1 [0118.210] CloseHandle (hObject=0x2e0) returned 1 [0118.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc", lpFilePart=0x0) returned 0x2c [0118.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0118.212] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc.rogue", lpFilePart=0x0) returned 0x32 [0118.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0118.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\eypbgnqv8vptqvlr.doc"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cecae0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x8959b2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x4f314664, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10d0)) returned 1 [0118.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0118.213] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\eypbgnqv8vptqvlr.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\EypBgNqV8vptqvLR.doc.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\eypbgnqv8vptqvlr.doc.rogue")) returned 1 [0118.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.214] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", lpFilePart=0x0) returned 0x2c [0118.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0118.214] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5bzb0ih1sgyeil.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.214] GetFileType (hFile=0x2e0) returned 0x1 [0118.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0118.214] GetFileType (hFile=0x2e0) returned 0x1 [0118.214] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x2ee6 [0118.214] ReadFile (in: hFile=0x2e0, lpBuffer=0x2a9ed50, nNumberOfBytesToRead=0x2ee6, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2a9ed50*, lpNumberOfBytesRead=0x8fec60*=0x2ee6, lpOverlapped=0x0) returned 1 [0118.215] CloseHandle (hObject=0x2e0) returned 1 [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0118.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0118.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0118.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", lpFilePart=0x0) returned 0x2c [0118.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0118.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5bzb0ih1sgyeil.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.353] GetFileType (hFile=0x2e0) returned 0x1 [0118.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0118.353] GetFileType (hFile=0x2e0) returned 0x1 [0118.353] WriteFile (in: hFile=0x2e0, lpBuffer=0x2afa5ec*, nNumberOfBytesToWrite=0x2ef0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2afa5ec*, lpNumberOfBytesWritten=0x8fec54*=0x2ef0, lpOverlapped=0x0) returned 1 [0118.354] CloseHandle (hObject=0x2e0) returned 1 [0118.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0118.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx", lpFilePart=0x0) returned 0x2c [0118.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0118.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx.rogue", lpFilePart=0x0) returned 0x32 [0118.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0118.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5bzb0ih1sgyeil.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf7aa0, ftCreationTime.dwHighDateTime=0x1d5e0af, ftLastAccessTime.dwLowDateTime=0xbae41730, ftLastAccessTime.dwHighDateTime=0x1d5e930, ftLastWriteTime.dwLowDateTime=0x4f46bb92, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0)) returned 1 [0118.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0118.356] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\f5bzb0ih1sgyeil.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\f5bZB0iH1SGyEIL.docx.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\f5bzb0ih1sgyeil.docx.rogue")) returned 1 [0118.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0118.357] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", lpFilePart=0x0) returned 0x24 [0118.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0118.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ghcu9i52.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0118.357] GetFileType (hFile=0x2e0) returned 0x1 [0118.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0118.357] GetFileType (hFile=0x2e0) returned 0x1 [0118.357] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x30c7 [0118.358] ReadFile (in: hFile=0x2e0, lpBuffer=0x2afd764, nNumberOfBytesToRead=0x30c7, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2afd764*, lpNumberOfBytesRead=0x8fec60*=0x30c7, lpOverlapped=0x0) returned 1 [0118.358] CloseHandle (hObject=0x2e0) returned 1 [0119.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.166] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0119.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0119.166] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0119.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0119.167] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", lpFilePart=0x0) returned 0x24 [0119.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0119.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ghcu9i52.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0119.216] GetFileType (hFile=0x2e0) returned 0x1 [0119.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0119.216] GetFileType (hFile=0x2e0) returned 0x1 [0119.216] WriteFile (in: hFile=0x2e0, lpBuffer=0x28049d4*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28049d4*, lpNumberOfBytesWritten=0x8fec54*=0x30d0, lpOverlapped=0x0) returned 1 [0119.218] CloseHandle (hObject=0x2e0) returned 1 [0119.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0119.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi", lpFilePart=0x0) returned 0x24 [0119.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.317] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi.rogue", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi.rogue", lpFilePart=0x0) returned 0x2a [0119.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0119.317] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ghcu9i52.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a50d0, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0x26e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d5e89e, ftLastWriteTime.dwLowDateTime=0x4fcb334f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x30d0)) returned 1 [0119.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0119.317] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\ghcu9i52.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GhCu9i52.avi.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\ghcu9i52.avi.rogue")) returned 1 [0119.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0119.318] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", lpFilePart=0x0) returned 0x23 [0119.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0119.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\gj-ojky.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0119.319] GetFileType (hFile=0x2e0) returned 0x1 [0119.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0119.319] GetFileType (hFile=0x2e0) returned 0x1 [0119.319] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1700 [0119.319] ReadFile (in: hFile=0x2e0, lpBuffer=0x2807cf0, nNumberOfBytesToRead=0x1700, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2807cf0*, lpNumberOfBytesRead=0x8fec60*=0x1700, lpOverlapped=0x0) returned 1 [0119.320] CloseHandle (hObject=0x2e0) returned 1 [0119.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.443] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0119.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0119.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0119.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0119.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", lpFilePart=0x0) returned 0x23 [0119.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0119.445] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\gj-ojky.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0119.447] GetFileType (hFile=0x2e0) returned 0x1 [0119.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0119.448] GetFileType (hFile=0x2e0) returned 0x1 [0119.448] WriteFile (in: hFile=0x2e0, lpBuffer=0x285bf84*, nNumberOfBytesToWrite=0x1710, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x285bf84*, lpNumberOfBytesWritten=0x8fec54*=0x1710, lpOverlapped=0x0) returned 1 [0119.449] CloseHandle (hObject=0x2e0) returned 1 [0119.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0119.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt", lpFilePart=0x0) returned 0x23 [0119.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0119.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt.rogue", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt.rogue", lpFilePart=0x0) returned 0x29 [0119.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0119.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\gj-ojky.odt"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe55d7df0, ftCreationTime.dwHighDateTime=0x1d5e46f, ftLastAccessTime.dwLowDateTime=0x246ab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e306, ftLastWriteTime.dwLowDateTime=0x4feef644, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1710)) returned 1 [0119.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0119.452] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\gj-ojky.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GJ-ojKY.odt.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\gj-ojky.odt.rogue")) returned 1 [0119.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", lpFilePart=0x0) returned 0x2a [0119.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0119.453] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nif1ltaffquplp.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0119.453] GetFileType (hFile=0x2e0) returned 0x1 [0119.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0119.454] GetFileType (hFile=0x2e0) returned 0x1 [0119.454] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1535f [0119.454] ReadFile (in: hFile=0x2e0, lpBuffer=0x382f4a8, nNumberOfBytesToRead=0x1535f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x382f4a8*, lpNumberOfBytesRead=0x8fec60*=0x1535f, lpOverlapped=0x0) returned 1 [0119.457] CloseHandle (hObject=0x2e0) returned 1 [0119.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0119.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0119.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0119.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0119.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.614] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", lpFilePart=0x0) returned 0x2a [0119.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0119.614] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nif1ltaffquplp.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0119.616] GetFileType (hFile=0x2e0) returned 0x1 [0119.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0119.616] GetFileType (hFile=0x2e0) returned 0x1 [0119.616] WriteFile (in: hFile=0x2e0, lpBuffer=0x38995c8*, nNumberOfBytesToWrite=0x15360, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x38995c8*, lpNumberOfBytesWritten=0x8fec54*=0x15360, lpOverlapped=0x0) returned 1 [0119.618] CloseHandle (hObject=0x2e0) returned 1 [0119.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0119.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc", lpFilePart=0x0) returned 0x2a [0119.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0119.624] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc.rogue", lpFilePart=0x0) returned 0x30 [0119.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0119.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nif1ltaffquplp.doc"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8cfe60, ftCreationTime.dwHighDateTime=0x1d5e7f4, ftLastAccessTime.dwLowDateTime=0x8ca30b10, ftLastAccessTime.dwHighDateTime=0x1d5efa7, ftLastWriteTime.dwLowDateTime=0x50093287, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15360)) returned 1 [0119.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0119.625] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\nif1ltaffquplp.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nIF1LtAffQUPlp.doc.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\nif1ltaffquplp.doc.rogue")) returned 1 [0120.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.018] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", lpFilePart=0x0) returned 0x30 [0120.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0120.018] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\pek24xl wxfa3n65bg6t.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.018] GetFileType (hFile=0x2e0) returned 0x1 [0120.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0120.018] GetFileType (hFile=0x2e0) returned 0x1 [0120.018] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x138fe [0120.019] ReadFile (in: hFile=0x2e0, lpBuffer=0x28aa9e8, nNumberOfBytesToRead=0x138fe, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28aa9e8*, lpNumberOfBytesRead=0x8fec60*=0x138fe, lpOverlapped=0x0) returned 1 [0120.019] CloseHandle (hObject=0x2e0) returned 1 [0120.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0120.192] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0120.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0120.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0120.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.193] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", lpFilePart=0x0) returned 0x30 [0120.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0120.193] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\pek24xl wxfa3n65bg6t.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.195] GetFileType (hFile=0x2e0) returned 0x1 [0120.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0120.195] GetFileType (hFile=0x2e0) returned 0x1 [0120.195] WriteFile (in: hFile=0x2e0, lpBuffer=0x29322e8*, nNumberOfBytesToWrite=0x13900, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29322e8*, lpNumberOfBytesWritten=0x8fec54*=0x13900, lpOverlapped=0x0) returned 1 [0120.198] CloseHandle (hObject=0x2e0) returned 1 [0120.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi", lpFilePart=0x0) returned 0x30 [0120.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0120.202] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi.rogue", lpFilePart=0x0) returned 0x36 [0120.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0120.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\pek24xl wxfa3n65bg6t.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec33970, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6603b4e0, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x506049b5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13900)) returned 1 [0120.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0120.202] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\pek24xl wxfa3n65bg6t.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Pek24XL WXFA3n65bg6t.avi.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\pek24xl wxfa3n65bg6t.avi.rogue")) returned 1 [0120.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0120.203] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", lpFilePart=0x0) returned 0x24 [0120.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0120.204] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\pnmfbvrh.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.204] GetFileType (hFile=0x2e0) returned 0x1 [0120.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0120.204] GetFileType (hFile=0x2e0) returned 0x1 [0120.204] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x14d2e [0120.205] ReadFile (in: hFile=0x2e0, lpBuffer=0x38d5b48, nNumberOfBytesToRead=0x14d2e, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x38d5b48*, lpNumberOfBytesRead=0x8fec60*=0x14d2e, lpOverlapped=0x0) returned 1 [0120.257] CloseHandle (hObject=0x2e0) returned 1 [0120.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0120.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0120.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0120.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0120.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0120.391] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", lpFilePart=0x0) returned 0x24 [0120.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0120.391] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\pnmfbvrh.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.443] GetFileType (hFile=0x2e0) returned 0x1 [0120.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0120.444] GetFileType (hFile=0x2e0) returned 0x1 [0120.444] WriteFile (in: hFile=0x2e0, lpBuffer=0x393dd78*, nNumberOfBytesToWrite=0x14d30, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x393dd78*, lpNumberOfBytesWritten=0x8fec54*=0x14d30, lpOverlapped=0x0) returned 1 [0120.447] CloseHandle (hObject=0x2e0) returned 1 [0120.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0120.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv", lpFilePart=0x0) returned 0x24 [0120.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0120.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv.rogue", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv.rogue", lpFilePart=0x0) returned 0x2a [0120.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0120.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\pnmfbvrh.csv"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1cb5ef0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xab75a600, ftLastAccessTime.dwHighDateTime=0x1d5f0a2, ftLastWriteTime.dwLowDateTime=0x50866dc0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14d30)) returned 1 [0120.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0120.452] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\pnmfbvrh.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\PnMfbvrh.csv.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\pnmfbvrh.csv.rogue")) returned 1 [0120.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", lpFilePart=0x0) returned 0x30 [0120.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0120.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\rco0gue3oxjrzfq4kapb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.454] GetFileType (hFile=0x2e0) returned 0x1 [0120.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0120.454] GetFileType (hFile=0x2e0) returned 0x1 [0120.454] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xa584 [0120.455] ReadFile (in: hFile=0x2e0, lpBuffer=0x2992ed8, nNumberOfBytesToRead=0xa584, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2992ed8*, lpNumberOfBytesRead=0x8fec60*=0xa584, lpOverlapped=0x0) returned 1 [0120.455] CloseHandle (hObject=0x2e0) returned 1 [0120.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0120.799] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0120.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0120.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0120.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0120.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0120.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", lpFilePart=0x0) returned 0x30 [0120.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0120.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\rco0gue3oxjrzfq4kapb.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0120.812] GetFileType (hFile=0x2e0) returned 0x1 [0120.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0120.812] GetFileType (hFile=0x2e0) returned 0x1 [0120.812] WriteFile (in: hFile=0x2e0, lpBuffer=0x281a4a0*, nNumberOfBytesToWrite=0xa590, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x281a4a0*, lpNumberOfBytesWritten=0x8fec54*=0xa590, lpOverlapped=0x0) returned 1 [0120.814] CloseHandle (hObject=0x2e0) returned 1 [0121.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0121.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4", lpFilePart=0x0) returned 0x30 [0121.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0121.069] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4.rogue", lpFilePart=0x0) returned 0x36 [0121.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0121.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\rco0gue3oxjrzfq4kapb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4415660, ftCreationTime.dwHighDateTime=0x1d5e968, ftLastAccessTime.dwLowDateTime=0xd74b0e00, ftLastAccessTime.dwHighDateTime=0x1d5f039, ftLastWriteTime.dwLowDateTime=0x50e5cd0a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa590)) returned 1 [0121.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0121.070] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\rco0gue3oxjrzfq4kapb.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\rCo0GuE3OXJRzFQ4kaPB.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\rco0gue3oxjrzfq4kapb.mp4.rogue")) returned 1 [0121.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.071] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", lpFilePart=0x0) returned 0x2f [0121.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0121.071] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rrzhs3yoco su 9qp0t.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0121.071] GetFileType (hFile=0x2e0) returned 0x1 [0121.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0121.071] GetFileType (hFile=0x2e0) returned 0x1 [0121.071] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x68d8 [0121.071] ReadFile (in: hFile=0x2e0, lpBuffer=0x2824cdc, nNumberOfBytesToRead=0x68d8, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2824cdc*, lpNumberOfBytesRead=0x8fec60*=0x68d8, lpOverlapped=0x0) returned 1 [0121.072] CloseHandle (hObject=0x2e0) returned 1 [0121.236] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.237] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0121.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0121.237] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0121.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.238] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", lpFilePart=0x0) returned 0x2f [0121.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0121.238] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rrzhs3yoco su 9qp0t.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0121.239] GetFileType (hFile=0x2e0) returned 0x1 [0121.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0121.240] GetFileType (hFile=0x2e0) returned 0x1 [0121.240] WriteFile (in: hFile=0x2e0, lpBuffer=0x2892880*, nNumberOfBytesToWrite=0x68e0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2892880*, lpNumberOfBytesWritten=0x8fec54*=0x68e0, lpOverlapped=0x0) returned 1 [0121.241] CloseHandle (hObject=0x2e0) returned 1 [0121.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0121.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3", lpFilePart=0x0) returned 0x2f [0121.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0121.245] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3.rogue", nBufferLength=0x36, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3.rogue", lpFilePart=0x0) returned 0x35 [0121.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0121.245] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rrzhs3yoco su 9qp0t.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75aed30, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xa53e2ca0, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0x510007cb, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0)) returned 1 [0121.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0121.245] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\rrzhs3yoco su 9qp0t.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\RRzHs3YOcO Su 9Qp0T.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\rrzhs3yoco su 9qp0t.mp3.rogue")) returned 1 [0121.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.246] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", lpFilePart=0x0) returned 0x2c [0121.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0121.246] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\vhjrcn1z8ksualv3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0121.247] GetFileType (hFile=0x2e0) returned 0x1 [0121.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0121.247] GetFileType (hFile=0x2e0) returned 0x1 [0121.247] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x5e78 [0121.247] ReadFile (in: hFile=0x2e0, lpBuffer=0x2899400, nNumberOfBytesToRead=0x5e78, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2899400*, lpNumberOfBytesRead=0x8fec60*=0x5e78, lpOverlapped=0x0) returned 1 [0121.248] CloseHandle (hObject=0x2e0) returned 1 [0121.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.385] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0121.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0121.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0121.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.386] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", lpFilePart=0x0) returned 0x2c [0121.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0121.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\vhjrcn1z8ksualv3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0121.439] GetFileType (hFile=0x2e0) returned 0x1 [0121.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0121.439] GetFileType (hFile=0x2e0) returned 0x1 [0121.439] WriteFile (in: hFile=0x2e0, lpBuffer=0x2903a68*, nNumberOfBytesToWrite=0x5e80, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2903a68*, lpNumberOfBytesWritten=0x8fec54*=0x5e80, lpOverlapped=0x0) returned 1 [0121.441] CloseHandle (hObject=0x2e0) returned 1 [0121.532] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0121.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4", lpFilePart=0x0) returned 0x2c [0121.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0121.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4.rogue", lpFilePart=0x0) returned 0x32 [0121.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0121.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\vhjrcn1z8ksualv3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9d640, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0xa7c2a910, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0x511f04dd, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5e80)) returned 1 [0121.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0121.533] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\vhjrcn1z8ksualv3.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\VhJrCn1z8KsualV3.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\vhjrcn1z8ksualv3.mp4.rogue")) returned 1 [0121.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0121.623] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", lpFilePart=0x0) returned 0x2d [0121.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0121.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\voujrzjupxmr_vcgq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0121.624] GetFileType (hFile=0x2e0) returned 0x1 [0121.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0121.624] GetFileType (hFile=0x2e0) returned 0x1 [0121.624] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x5181 [0121.624] ReadFile (in: hFile=0x2e0, lpBuffer=0x2909b68, nNumberOfBytesToRead=0x5181, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2909b68*, lpNumberOfBytesRead=0x8fec60*=0x5181, lpOverlapped=0x0) returned 1 [0121.624] CloseHandle (hObject=0x2e0) returned 1 [0121.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0121.968] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0121.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0121.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0121.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0121.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0121.969] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", lpFilePart=0x0) returned 0x2d [0121.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0121.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\voujrzjupxmr_vcgq.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0122.021] GetFileType (hFile=0x2e0) returned 0x1 [0122.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0122.022] GetFileType (hFile=0x2e0) returned 0x1 [0122.022] WriteFile (in: hFile=0x2e0, lpBuffer=0x2970124*, nNumberOfBytesToWrite=0x5190, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2970124*, lpNumberOfBytesWritten=0x8fec54*=0x5190, lpOverlapped=0x0) returned 1 [0122.023] CloseHandle (hObject=0x2e0) returned 1 [0122.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0122.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3", lpFilePart=0x0) returned 0x2d [0122.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0122.133] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3.rogue", nBufferLength=0x34, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3.rogue", lpFilePart=0x0) returned 0x33 [0122.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0122.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\voujrzjupxmr_vcgq.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5b6340, ftCreationTime.dwHighDateTime=0x1d5e819, ftLastAccessTime.dwLowDateTime=0x9aefc950, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x51774094, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5190)) returned 1 [0122.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0122.134] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\voujrzjupxmr_vcgq.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vOuJrZJUPXMR_VcGq.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\voujrzjupxmr_vcgq.mp3.rogue")) returned 1 [0122.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.195] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", lpFilePart=0x0) returned 0x2c [0122.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0122.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\wuh_ox1zbfpq-nse.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0122.195] GetFileType (hFile=0x2e0) returned 0x1 [0122.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0122.195] GetFileType (hFile=0x2e0) returned 0x1 [0122.195] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x100f [0122.195] ReadFile (in: hFile=0x2e0, lpBuffer=0x297554c, nNumberOfBytesToRead=0x100f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x297554c*, lpNumberOfBytesRead=0x8fec60*=0x100f, lpOverlapped=0x0) returned 1 [0122.196] CloseHandle (hObject=0x2e0) returned 1 [0122.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0122.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0122.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0122.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0122.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", lpFilePart=0x0) returned 0x2c [0122.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0122.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\wuh_ox1zbfpq-nse.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0122.483] GetFileType (hFile=0x2e0) returned 0x1 [0122.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0122.483] GetFileType (hFile=0x2e0) returned 0x1 [0122.483] WriteFile (in: hFile=0x2e0, lpBuffer=0x27df134*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x27df134*, lpNumberOfBytesWritten=0x8fec54*=0x1010, lpOverlapped=0x0) returned 1 [0122.485] CloseHandle (hObject=0x2e0) returned 1 [0122.486] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0122.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi", lpFilePart=0x0) returned 0x2c [0122.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0122.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi.rogue", lpFilePart=0x0) returned 0x32 [0122.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0122.487] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\wuh_ox1zbfpq-nse.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df682d0, ftCreationTime.dwHighDateTime=0x1d5ec6f, ftLastAccessTime.dwLowDateTime=0x8925ac00, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x51bc6096, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1010)) returned 1 [0122.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0122.487] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\wuh_ox1zbfpq-nse.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\wUH_OX1ZBfpq-NsE.avi.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\wuh_ox1zbfpq-nse.avi.rogue")) returned 1 [0122.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0122.488] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", lpFilePart=0x0) returned 0x22 [0122.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0122.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ycczzh.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0122.489] GetFileType (hFile=0x2e0) returned 0x1 [0122.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0122.489] GetFileType (hFile=0x2e0) returned 0x1 [0122.489] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x15b39 [0122.490] ReadFile (in: hFile=0x2e0, lpBuffer=0x3952ac8, nNumberOfBytesToRead=0x15b39, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x3952ac8*, lpNumberOfBytesRead=0x8fec60*=0x15b39, lpOverlapped=0x0) returned 1 [0122.493] CloseHandle (hObject=0x2e0) returned 1 [0122.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0122.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0122.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0122.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0122.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0122.762] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", lpFilePart=0x0) returned 0x22 [0122.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0122.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ycczzh.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0123.285] GetFileType (hFile=0x2e0) returned 0x1 [0123.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0123.285] GetFileType (hFile=0x2e0) returned 0x1 [0123.285] WriteFile (in: hFile=0x2e0, lpBuffer=0x39bf340*, nNumberOfBytesToWrite=0x15b40, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x39bf340*, lpNumberOfBytesWritten=0x8fec54*=0x15b40, lpOverlapped=0x0) returned 1 [0123.288] CloseHandle (hObject=0x2e0) returned 1 [0123.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0123.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3", lpFilePart=0x0) returned 0x22 [0123.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0123.293] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3.rogue", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3.rogue", lpFilePart=0x0) returned 0x28 [0123.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0123.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ycczzh.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1774a980, ftCreationTime.dwHighDateTime=0x1d5e998, ftLastAccessTime.dwLowDateTime=0x8a322330, ftLastAccessTime.dwHighDateTime=0x1d5e5c4, ftLastWriteTime.dwLowDateTime=0x52385a0c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15b40)) returned 1 [0123.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0123.293] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\ycczzh.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YCczzh.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\ycczzh.mp3.rogue")) returned 1 [0123.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0123.294] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", lpFilePart=0x0) returned 0x28 [0123.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0123.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\z7j0cg9uhbzs.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0123.294] GetFileType (hFile=0x2e0) returned 0x1 [0123.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0123.294] GetFileType (hFile=0x2e0) returned 0x1 [0123.294] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1318e [0123.295] ReadFile (in: hFile=0x2e0, lpBuffer=0x282d568, nNumberOfBytesToRead=0x1318e, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x282d568*, lpNumberOfBytesRead=0x8fec60*=0x1318e, lpOverlapped=0x0) returned 1 [0123.296] CloseHandle (hObject=0x2e0) returned 1 [0124.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.319] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0124.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0124.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0124.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0124.320] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", lpFilePart=0x0) returned 0x28 [0124.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0124.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\z7j0cg9uhbzs.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0124.382] GetFileType (hFile=0x2e0) returned 0x1 [0124.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0124.382] GetFileType (hFile=0x2e0) returned 0x1 [0124.382] WriteFile (in: hFile=0x2e0, lpBuffer=0x28b3818*, nNumberOfBytesToWrite=0x13190, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28b3818*, lpNumberOfBytesWritten=0x8fec54*=0x13190, lpOverlapped=0x0) returned 1 [0124.385] CloseHandle (hObject=0x2e0) returned 1 [0124.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0124.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4", lpFilePart=0x0) returned 0x28 [0124.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0124.405] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4.rogue", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4.rogue", lpFilePart=0x0) returned 0x2e [0124.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0124.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\z7j0cg9uhbzs.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123678f0, ftCreationTime.dwHighDateTime=0x1d5e799, ftLastAccessTime.dwLowDateTime=0xd64d0950, ftLastAccessTime.dwHighDateTime=0x1d5f015, ftLastWriteTime.dwLowDateTime=0x52df3d98, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13190)) returned 1 [0124.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0124.406] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\z7j0cg9uhbzs.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\z7J0cG9uHbZs.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\z7j0cg9uhbzs.mp4.rogue")) returned 1 [0124.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0124.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0124.440] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x21, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", lpFilePart=0x0) returned 0x20 [0124.441] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd68 [0124.442] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.442] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285c9e10, ftCreationTime.dwHighDateTime=0x1d5ec68, ftLastAccessTime.dwLowDateTime=0xa5c9dff0, ftLastAccessTime.dwHighDateTime=0x1d5ea58, ftLastWriteTime.dwLowDateTime=0xa5c9dff0, ftLastWriteTime.dwHighDateTime=0x1d5ea58, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxyVMo6BxgALnPs.bmp", cAlternateFileName="CXYVMO~1.BMP")) returned 1 [0124.442] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3407d060, ftCreationTime.dwHighDateTime=0x1d5ed33, ftLastAccessTime.dwLowDateTime=0xa43b7710, ftLastAccessTime.dwHighDateTime=0x1d5e41e, ftLastWriteTime.dwLowDateTime=0xa43b7710, ftLastWriteTime.dwHighDateTime=0x1d5e41e, nFileSizeHigh=0x0, nFileSizeLow=0xee9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e801hOBrDr.gif", cAlternateFileName="E801HO~1.GIF")) returned 1 [0124.442] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45650800, ftCreationTime.dwHighDateTime=0x1d5ebfd, ftLastAccessTime.dwLowDateTime=0xd54d4490, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0xd54d4490, ftLastWriteTime.dwHighDateTime=0x1d5e6a9, nFileSizeHigh=0x0, nFileSizeLow=0x9aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXogTPXi9b7b.bmp", cAlternateFileName="GXOGTP~1.BMP")) returned 1 [0124.442] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7db3400, ftCreationTime.dwHighDateTime=0x1d5ef37, ftLastAccessTime.dwLowDateTime=0x4f17de50, ftLastAccessTime.dwHighDateTime=0x1d5eb6b, ftLastWriteTime.dwLowDateTime=0x4f17de50, ftLastWriteTime.dwHighDateTime=0x1d5eb6b, nFileSizeHigh=0x0, nFileSizeLow=0x68dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HyN88W3lv0C.xls", cAlternateFileName="HYN88W~1.XLS")) returned 1 [0124.443] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1fe2c0, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x1ca7d420, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0x1ca7d420, ftLastWriteTime.dwHighDateTime=0x1d5e521, nFileSizeHigh=0x0, nFileSizeLow=0x16379, dwReserved0=0x0, dwReserved1=0x0, cFileName="Me3a.jpg", cAlternateFileName="")) returned 1 [0124.443] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d43d0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0xb0a55ae0, ftLastAccessTime.dwHighDateTime=0x1d5ea8e, ftLastWriteTime.dwLowDateTime=0xb0a55ae0, ftLastWriteTime.dwHighDateTime=0x1d5ea8e, nFileSizeHigh=0x0, nFileSizeLow=0x375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOQshVhma.rtf", cAlternateFileName="TOQSHV~1.RTF")) returned 1 [0124.443] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0xf31067a0, ftLastWriteTime.dwHighDateTime=0x1d5e8de, nFileSizeHigh=0x0, nFileSizeLow=0x10d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3", cAlternateFileName="XHURU1~1.MP3")) returned 1 [0124.443] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.443] FindClose (in: hFindFile=0x7a5fd68 | out: hFindFile=0x7a5fd68) returned 1 [0124.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0124.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0124.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0124.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0124.444] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x21, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", lpFilePart=0x0) returned 0x20 [0124.444] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f768 [0124.444] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x9aeb8ea0, ftLastAccessTime.dwHighDateTime=0x1d5f0a0, ftLastWriteTime.dwLowDateTime=0x9aeb8ea0, ftLastWriteTime.dwHighDateTime=0x1d5f0a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.445] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285c9e10, ftCreationTime.dwHighDateTime=0x1d5ec68, ftLastAccessTime.dwLowDateTime=0xa5c9dff0, ftLastAccessTime.dwHighDateTime=0x1d5ea58, ftLastWriteTime.dwLowDateTime=0xa5c9dff0, ftLastWriteTime.dwHighDateTime=0x1d5ea58, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxyVMo6BxgALnPs.bmp", cAlternateFileName="CXYVMO~1.BMP")) returned 1 [0124.445] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3407d060, ftCreationTime.dwHighDateTime=0x1d5ed33, ftLastAccessTime.dwLowDateTime=0xa43b7710, ftLastAccessTime.dwHighDateTime=0x1d5e41e, ftLastWriteTime.dwLowDateTime=0xa43b7710, ftLastWriteTime.dwHighDateTime=0x1d5e41e, nFileSizeHigh=0x0, nFileSizeLow=0xee9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e801hOBrDr.gif", cAlternateFileName="E801HO~1.GIF")) returned 1 [0124.445] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45650800, ftCreationTime.dwHighDateTime=0x1d5ebfd, ftLastAccessTime.dwLowDateTime=0xd54d4490, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0xd54d4490, ftLastWriteTime.dwHighDateTime=0x1d5e6a9, nFileSizeHigh=0x0, nFileSizeLow=0x9aa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXogTPXi9b7b.bmp", cAlternateFileName="GXOGTP~1.BMP")) returned 1 [0124.445] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7db3400, ftCreationTime.dwHighDateTime=0x1d5ef37, ftLastAccessTime.dwLowDateTime=0x4f17de50, ftLastAccessTime.dwHighDateTime=0x1d5eb6b, ftLastWriteTime.dwLowDateTime=0x4f17de50, ftLastWriteTime.dwHighDateTime=0x1d5eb6b, nFileSizeHigh=0x0, nFileSizeLow=0x68dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HyN88W3lv0C.xls", cAlternateFileName="HYN88W~1.XLS")) returned 1 [0124.445] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1fe2c0, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x1ca7d420, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0x1ca7d420, ftLastWriteTime.dwHighDateTime=0x1d5e521, nFileSizeHigh=0x0, nFileSizeLow=0x16379, dwReserved0=0x0, dwReserved1=0x0, cFileName="Me3a.jpg", cAlternateFileName="")) returned 1 [0124.446] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d43d0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0xb0a55ae0, ftLastAccessTime.dwHighDateTime=0x1d5ea8e, ftLastWriteTime.dwLowDateTime=0xb0a55ae0, ftLastWriteTime.dwHighDateTime=0x1d5ea8e, nFileSizeHigh=0x0, nFileSizeLow=0x375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOQshVhma.rtf", cAlternateFileName="TOQSHV~1.RTF")) returned 1 [0124.446] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0xf31067a0, ftLastWriteTime.dwHighDateTime=0x1d5e8de, nFileSizeHigh=0x0, nFileSizeLow=0x10d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3", cAlternateFileName="XHURU1~1.MP3")) returned 1 [0124.446] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0xf31067a0, ftLastWriteTime.dwHighDateTime=0x1d5e8de, nFileSizeHigh=0x0, nFileSizeLow=0x10d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3", cAlternateFileName="XHURU1~1.MP3")) returned 0 [0124.446] FindClose (in: hFindFile=0x7a5f768 | out: hFindFile=0x7a5f768) returned 1 [0124.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0124.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0124.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.447] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", lpFilePart=0x0) returned 0x34 [0124.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0124.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\cxyvmo6bxgalnps.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0124.447] GetFileType (hFile=0x2e0) returned 0x1 [0124.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0124.447] GetFileType (hFile=0x2e0) returned 0x1 [0124.447] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x1390 [0124.447] ReadFile (in: hFile=0x2e0, lpBuffer=0x28c8a18, nNumberOfBytesToRead=0x1390, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28c8a18*, lpNumberOfBytesRead=0x8febe8*=0x1390, lpOverlapped=0x0) returned 1 [0124.449] CloseHandle (hObject=0x2e0) returned 1 [0124.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0124.782] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0124.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0124.782] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0124.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", lpFilePart=0x0) returned 0x34 [0124.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0124.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\cxyvmo6bxgalnps.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0124.855] GetFileType (hFile=0x2e0) returned 0x1 [0124.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0124.855] GetFileType (hFile=0x2e0) returned 0x1 [0124.855] WriteFile (in: hFile=0x2e0, lpBuffer=0x291ba20*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x291ba20*, lpNumberOfBytesWritten=0x8febdc*=0x13a0, lpOverlapped=0x0) returned 1 [0124.856] CloseHandle (hObject=0x2e0) returned 1 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp", lpFilePart=0x0) returned 0x34 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp.rogue", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp.rogue", lpFilePart=0x0) returned 0x3a [0124.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0124.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\cxyvmo6bxgalnps.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285c9e10, ftCreationTime.dwHighDateTime=0x1d5ec68, ftLastAccessTime.dwLowDateTime=0xa5c9dff0, ftLastAccessTime.dwHighDateTime=0x1d5ea58, ftLastWriteTime.dwLowDateTime=0x5326d609, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13a0)) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0124.989] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\cxyvmo6bxgalnps.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\cxyVMo6BxgALnPs.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\cxyvmo6bxgalnps.bmp.rogue")) returned 1 [0125.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", lpFilePart=0x0) returned 0x31 [0125.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0125.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\gxogtpxi9b7b.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0125.088] GetFileType (hFile=0x2e0) returned 0x1 [0125.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0125.088] GetFileType (hFile=0x2e0) returned 0x1 [0125.088] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x9aa3 [0125.089] ReadFile (in: hFile=0x2e0, lpBuffer=0x291d05c, nNumberOfBytesToRead=0x9aa3, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x291d05c*, lpNumberOfBytesRead=0x8febe8*=0x9aa3, lpOverlapped=0x0) returned 1 [0125.090] CloseHandle (hObject=0x2e0) returned 1 [0125.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0125.401] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0125.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0125.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0125.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0125.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.403] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", lpFilePart=0x0) returned 0x31 [0125.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0125.403] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\gxogtpxi9b7b.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0125.464] GetFileType (hFile=0x2e0) returned 0x1 [0125.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0125.464] GetFileType (hFile=0x2e0) returned 0x1 [0125.464] WriteFile (in: hFile=0x2e0, lpBuffer=0x299a3b8*, nNumberOfBytesToWrite=0x9ab0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x299a3b8*, lpNumberOfBytesWritten=0x8febdc*=0x9ab0, lpOverlapped=0x0) returned 1 [0125.466] CloseHandle (hObject=0x2e0) returned 1 [0125.563] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0125.563] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp", lpFilePart=0x0) returned 0x31 [0125.563] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0125.563] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp.rogue", lpFilePart=0x0) returned 0x37 [0125.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0125.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\gxogtpxi9b7b.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45650800, ftCreationTime.dwHighDateTime=0x1d5ebfd, ftLastAccessTime.dwLowDateTime=0xd54d4490, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0x5384c3c7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9ab0)) returned 1 [0125.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0125.564] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\gxogtpxi9b7b.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\gXogTPXi9b7b.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\gxogtpxi9b7b.bmp.rogue")) returned 1 [0125.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0125.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", lpFilePart=0x0) returned 0x30 [0125.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0125.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\hyn88w3lv0c.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0125.658] GetFileType (hFile=0x2e0) returned 0x1 [0125.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0125.658] GetFileType (hFile=0x2e0) returned 0x1 [0125.658] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x68dc [0125.659] ReadFile (in: hFile=0x2e0, lpBuffer=0x29a40dc, nNumberOfBytesToRead=0x68dc, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x29a40dc*, lpNumberOfBytesRead=0x8febe8*=0x68dc, lpOverlapped=0x0) returned 1 [0125.660] CloseHandle (hObject=0x2e0) returned 1 [0126.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0126.411] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0126.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0126.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0126.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.412] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", lpFilePart=0x0) returned 0x30 [0126.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0126.412] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\hyn88w3lv0c.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0126.466] GetFileType (hFile=0x2e0) returned 0x1 [0126.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0126.466] GetFileType (hFile=0x2e0) returned 0x1 [0126.466] WriteFile (in: hFile=0x2e0, lpBuffer=0x2818ed8*, nNumberOfBytesToWrite=0x68e0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x2818ed8*, lpNumberOfBytesWritten=0x8febdc*=0x68e0, lpOverlapped=0x0) returned 1 [0126.467] CloseHandle (hObject=0x2e0) returned 1 [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls", lpFilePart=0x0) returned 0x30 [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0126.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls.rogue", lpFilePart=0x0) returned 0x36 [0126.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0126.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\hyn88w3lv0c.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7db3400, ftCreationTime.dwHighDateTime=0x1d5ef37, ftLastAccessTime.dwLowDateTime=0x4f17de50, ftLastAccessTime.dwHighDateTime=0x1d5eb6b, ftLastWriteTime.dwLowDateTime=0x541cfc40, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0)) returned 1 [0126.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0126.475] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\hyn88w3lv0c.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\HyN88W3lv0C.xls.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\hyn88w3lv0c.xls.rogue")) returned 1 [0126.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0126.539] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", lpFilePart=0x0) returned 0x29 [0126.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0126.539] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\me3a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0126.539] GetFileType (hFile=0x2e0) returned 0x1 [0126.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0126.539] GetFileType (hFile=0x2e0) returned 0x1 [0126.539] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x16379 [0126.540] ReadFile (in: hFile=0x2e0, lpBuffer=0x39fb1c0, nNumberOfBytesToRead=0x16379, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x39fb1c0*, lpNumberOfBytesRead=0x8febe8*=0x16379, lpOverlapped=0x0) returned 1 [0126.543] CloseHandle (hObject=0x2e0) returned 1 [0127.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0127.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0127.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0127.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0127.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0127.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", lpFilePart=0x0) returned 0x29 [0127.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0127.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\me3a.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0127.621] GetFileType (hFile=0x2e0) returned 0x1 [0127.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0127.621] GetFileType (hFile=0x2e0) returned 0x1 [0127.621] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a6a378*, nNumberOfBytesToWrite=0x16380, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x3a6a378*, lpNumberOfBytesWritten=0x8febdc*=0x16380, lpOverlapped=0x0) returned 1 [0127.624] CloseHandle (hObject=0x2e0) returned 1 [0127.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0127.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg", lpFilePart=0x0) returned 0x29 [0127.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0127.627] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg.rogue", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg.rogue", lpFilePart=0x0) returned 0x2f [0127.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0127.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\me3a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1fe2c0, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x1ca7d420, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0x54cd6bd3, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16380)) returned 1 [0127.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0127.628] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\me3a.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\Me3a.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\me3a.jpg.rogue")) returned 1 [0127.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0127.629] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", lpFilePart=0x0) returned 0x2e [0127.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0127.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\toqshvhma.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0127.630] GetFileType (hFile=0x2e0) returned 0x1 [0127.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0127.630] GetFileType (hFile=0x2e0) returned 0x1 [0127.630] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x375c [0127.630] ReadFile (in: hFile=0x2e0, lpBuffer=0x286cbbc, nNumberOfBytesToRead=0x375c, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x286cbbc*, lpNumberOfBytesRead=0x8febe8*=0x375c, lpOverlapped=0x0) returned 1 [0127.631] CloseHandle (hObject=0x2e0) returned 1 [0127.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0127.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0127.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0127.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0127.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0127.833] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", lpFilePart=0x0) returned 0x2e [0127.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0127.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\toqshvhma.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0127.890] GetFileType (hFile=0x2e0) returned 0x1 [0127.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0127.890] GetFileType (hFile=0x2e0) returned 0x1 [0127.890] WriteFile (in: hFile=0x2e0, lpBuffer=0x28cae84*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28cae84*, lpNumberOfBytesWritten=0x8febdc*=0x3760, lpOverlapped=0x0) returned 1 [0127.892] CloseHandle (hObject=0x2e0) returned 1 [0127.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0127.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf", lpFilePart=0x0) returned 0x2e [0127.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0127.894] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf.rogue", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf.rogue", lpFilePart=0x0) returned 0x34 [0127.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0127.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\toqshvhma.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d43d0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0xb0a55ae0, ftLastAccessTime.dwHighDateTime=0x1d5ea8e, ftLastWriteTime.dwLowDateTime=0x54f5f4b9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3760)) returned 1 [0127.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0127.895] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\toqshvhma.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\tOQshVhma.rtf.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\toqshvhma.rtf.rogue")) returned 1 [0127.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0127.896] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", lpFilePart=0x0) returned 0x31 [0127.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0127.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\xhuru100aeb4.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0127.896] GetFileType (hFile=0x2e0) returned 0x1 [0127.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0127.897] GetFileType (hFile=0x2e0) returned 0x1 [0127.897] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x10d90 [0127.897] ReadFile (in: hFile=0x2e0, lpBuffer=0x28ce850, nNumberOfBytesToRead=0x10d90, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28ce850*, lpNumberOfBytesRead=0x8febe8*=0x10d90, lpOverlapped=0x0) returned 1 [0127.899] CloseHandle (hObject=0x2e0) returned 1 [0128.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0128.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0128.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0128.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0128.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0128.046] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", lpFilePart=0x0) returned 0x31 [0128.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0128.046] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\xhuru100aeb4.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0128.047] GetFileType (hFile=0x2e0) returned 0x1 [0128.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0128.047] GetFileType (hFile=0x2e0) returned 0x1 [0128.047] WriteFile (in: hFile=0x2e0, lpBuffer=0x294df2c*, nNumberOfBytesToWrite=0x10da0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x294df2c*, lpNumberOfBytesWritten=0x8febdc*=0x10da0, lpOverlapped=0x0) returned 1 [0128.049] CloseHandle (hObject=0x2e0) returned 1 [0128.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0128.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3", lpFilePart=0x0) returned 0x31 [0128.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0128.052] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3.rogue", lpFilePart=0x0) returned 0x37 [0128.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0128.052] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\xhuru100aeb4.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10da0)) returned 1 [0128.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0128.053] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\xhuru100aeb4.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\XHuRU100Aeb4.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\desktop\\-yqn_4ok\\xhuru100aeb4.mp3.rogue")) returned 1 [0128.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0128.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x16 [0128.053] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x16, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0128.054] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fba8 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0128.055] FindNextFileW (in: hFindFile=0x7a5fba8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.055] FindClose (in: hFindFile=0x7a5fba8 | out: hFindFile=0x7a5fba8) returned 1 [0128.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0128.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0128.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0128.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x16 [0128.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links", nBufferLength=0x16, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links", lpFilePart=0x0) returned 0x15 [0128.056] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9e8 [0128.056] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.056] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.056] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0128.057] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0128.057] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0128.057] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0128.057] FindClose (in: hFindFile=0x7a5f9e8 | out: hFindFile=0x7a5f9e8) returned 1 [0128.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0128.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0128.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0128.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0128.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0128.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0128.059] GetFileType (hFile=0x2e0) returned 0x1 [0128.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0128.059] GetFileType (hFile=0x2e0) returned 0x1 [0128.059] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1f5 [0128.059] ReadFile (in: hFile=0x2e0, lpBuffer=0x2960264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2960264*, lpNumberOfBytesRead=0x8fec60*=0x1f5, lpOverlapped=0x0) returned 1 [0128.131] CloseHandle (hObject=0x2e0) returned 1 [0128.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0128.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0128.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0128.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0128.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0128.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0128.350] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0128.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0128.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0128.352] GetFileType (hFile=0x2e0) returned 0x1 [0128.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0128.352] GetFileType (hFile=0x2e0) returned 0x1 [0128.353] WriteFile (in: hFile=0x2e0, lpBuffer=0x29aeba4*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8fec28, lpOverlapped=0x0 | out: lpBuffer=0x29aeba4*, lpNumberOfBytesWritten=0x8fec28*=0x200, lpOverlapped=0x0) returned 1 [0128.354] CloseHandle (hObject=0x2e0) returned 1 [0128.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x22 [0128.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", nBufferLength=0x22, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x21 [0128.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0128.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.rogue", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.rogue", lpFilePart=0x0) returned 0x27 [0128.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0128.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x553d7a1b, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x200)) returned 1 [0128.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0128.355] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.rogue" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.rogue")) returned 1 [0128.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0128.356] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0128.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0128.356] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0128.357] GetFileType (hFile=0x2e0) returned 0x1 [0128.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0128.357] GetFileType (hFile=0x2e0) returned 0x1 [0128.357] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x3ae [0128.357] ReadFile (in: hFile=0x2e0, lpBuffer=0x29b0064, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29b0064*, lpNumberOfBytesRead=0x8fec60*=0x3ae, lpOverlapped=0x0) returned 1 [0128.990] CloseHandle (hObject=0x2e0) returned 1 [0129.346] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0129.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0129.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0129.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0129.348] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0129.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0129.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0129.350] GetFileType (hFile=0x2e0) returned 0x1 [0129.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0129.350] GetFileType (hFile=0x2e0) returned 0x1 [0129.350] WriteFile (in: hFile=0x2e0, lpBuffer=0x27d480c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x8fec28, lpOverlapped=0x0 | out: lpBuffer=0x27d480c*, lpNumberOfBytesWritten=0x8fec28*=0x3b0, lpOverlapped=0x0) returned 1 [0129.352] CloseHandle (hObject=0x2e0) returned 1 [0129.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0129.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x23 [0129.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0129.353] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.rogue", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.rogue", lpFilePart=0x0) returned 0x29 [0129.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0129.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x55d61077, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3b0)) returned 1 [0129.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0129.354] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.rogue" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.rogue")) returned 1 [0129.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0129.355] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0129.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0129.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0129.370] GetFileType (hFile=0x2e0) returned 0x1 [0129.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0129.370] GetFileType (hFile=0x2e0) returned 0x1 [0129.370] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x53a [0129.370] ReadFile (in: hFile=0x2e0, lpBuffer=0x27d5e5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x27d5e5c*, lpNumberOfBytesRead=0x8fec60*=0x53a, lpOverlapped=0x0) returned 1 [0129.380] CloseHandle (hObject=0x2e0) returned 1 [0129.692] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0129.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0129.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0129.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0129.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0129.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0129.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0129.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0129.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0129.695] GetFileType (hFile=0x2e0) returned 0x1 [0129.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0129.695] GetFileType (hFile=0x2e0) returned 0x1 [0129.696] WriteFile (in: hFile=0x2e0, lpBuffer=0x2825938*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x8fec28, lpOverlapped=0x0 | out: lpBuffer=0x2825938*, lpNumberOfBytesWritten=0x8fec28*=0x540, lpOverlapped=0x0) returned 1 [0129.697] CloseHandle (hObject=0x2e0) returned 1 [0129.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0129.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpFilePart=0x0) returned 0x22 [0129.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0129.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.rogue", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.rogue", lpFilePart=0x0) returned 0x28 [0129.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0129.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x560a8474, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x540)) returned 1 [0129.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0129.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.rogue" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.rogue")) returned 1 [0129.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0129.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0129.920] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0129.920] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f828 [0129.920] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.920] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.921] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.921] FindClose (in: hFindFile=0x7a5f828 | out: hFindFile=0x7a5f828) returned 1 [0129.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0129.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0129.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0129.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0129.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Contacts", lpFilePart=0x0) returned 0x18 [0129.921] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f828 [0129.921] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.921] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.922] FindNextFileW (in: hFindFile=0x7a5f828, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.922] FindClose (in: hFindFile=0x7a5f828 | out: hFindFile=0x7a5f828) returned 1 [0129.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0129.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0129.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0129.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0129.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0129.922] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52e1a13e, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x52e1a13e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fb68 [0129.922] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52e1a13e, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x52e1a13e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f28ef0, ftCreationTime.dwHighDateTime=0x1d5e3ee, ftLastAccessTime.dwLowDateTime=0x5f2be670, ftLastAccessTime.dwHighDateTime=0x1d5e6fb, ftLastWriteTime.dwLowDateTime=0x4db892ad, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xf2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-E6vb.png.rogue", cAlternateFileName="-E6VBP~1.ROG")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-YQN_4ok", cAlternateFileName="")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527fc7e0, ftCreationTime.dwHighDateTime=0x1d5ed20, ftLastAccessTime.dwLowDateTime=0x69684850, ftLastAccessTime.dwHighDateTime=0x1d5e2a9, ftLastWriteTime.dwLowDateTime=0x69684850, ftLastWriteTime.dwHighDateTime=0x1d5e2a9, nFileSizeHigh=0x0, nFileSizeLow=0x3705, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FxWXQvhHte.flv", cAlternateFileName="0FXWXQ~1.FLV")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6b39180, ftCreationTime.dwHighDateTime=0x1d5eb20, ftLastAccessTime.dwLowDateTime=0xd12b5a80, ftLastAccessTime.dwHighDateTime=0x1d5f010, ftLastWriteTime.dwLowDateTime=0xd12b5a80, ftLastWriteTime.dwHighDateTime=0x1d5f010, nFileSizeHigh=0x0, nFileSizeLow=0x14dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0n4ffGQfu yw.wav", cAlternateFileName="0N4FFG~1.WAV")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3835d140, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x64451630, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x64451630, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="4tbjYPC2CtDfATrinO.flv", cAlternateFileName="4TBJYP~1.FLV")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9fc510, ftCreationTime.dwHighDateTime=0x1d5e609, ftLastAccessTime.dwLowDateTime=0x7064acf0, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x7064acf0, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x70e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5PyHess87lIBo6JIW5aj.pps", cAlternateFileName="5PYHES~1.PPS")) returned 1 [0129.923] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde64a6a0, ftCreationTime.dwHighDateTime=0x1d5e2d4, ftLastAccessTime.dwLowDateTime=0x1b78bf40, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x4df519c0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Zi0ioEVH3f.jpg.rogue", cAlternateFileName="8ZI0IO~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf380, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc3b61c70, ftLastAccessTime.dwHighDateTime=0x1d5f08b, ftLastWriteTime.dwLowDateTime=0x4e643c8d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x6240, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlFSG6N2i2xrk.mp3.rogue", cAlternateFileName="ALFSG6~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebd030, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xadad9e00, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0x4eae25a0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xe210, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlMEPM.mkv.rogue", cAlternateFileName="ALMEPM~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf33ef0, ftCreationTime.dwHighDateTime=0x1d5e463, ftLastAccessTime.dwLowDateTime=0xf9eb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xf9eb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0xab54, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOutOKzxVGxo6odR.flv", cAlternateFileName="BOUTOK~1.FLV")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x577c3040, ftCreationTime.dwHighDateTime=0x1d5e626, ftLastAccessTime.dwLowDateTime=0x133adaf0, ftLastAccessTime.dwHighDateTime=0x1d5f0ec, ftLastWriteTime.dwLowDateTime=0x4ecd23c6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBErHk4e0egQ IF.mp4.rogue", cAlternateFileName="CBERHK~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f3e2e0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x8d2bb1f0, ftLastAccessTime.dwHighDateTime=0x1d5e344, ftLastWriteTime.dwLowDateTime=0x4ef0e617, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xac40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cnp7ZWz4-nJIM8 C.jpg.rogue", cAlternateFileName="CNP7ZW~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b63f30, ftCreationTime.dwHighDateTime=0x1d5ec75, ftLastAccessTime.dwLowDateTime=0x260a6b60, ftLastAccessTime.dwHighDateTime=0x1d5f073, ftLastWriteTime.dwLowDateTime=0x4eff34f9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cY1wsK8aC.xlsx.rogue", cAlternateFileName="CY1WSK~1.ROG")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.924] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1814bd0, ftCreationTime.dwHighDateTime=0x1d5e6ab, ftLastAccessTime.dwLowDateTime=0x4b0668b0, ftLastAccessTime.dwHighDateTime=0x1d5ef24, ftLastWriteTime.dwLowDateTime=0x4b0668b0, ftLastWriteTime.dwHighDateTime=0x1d5ef24, nFileSizeHigh=0x0, nFileSizeLow=0x1106b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFMaAmn3-uq.wav", cAlternateFileName="DFMAAM~1.WAV")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4954dd0, ftCreationTime.dwHighDateTime=0x1d5ed0d, ftLastAccessTime.dwLowDateTime=0xa2d1380, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xa2d1380, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x10af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5-Yp.wav", cAlternateFileName="")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e443c30, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0x8156e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e962, ftLastWriteTime.dwLowDateTime=0x4f170cf6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9410, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePeV1LzXYWIIRk7D.mp3.rogue", cAlternateFileName="EPEV1L~1.ROG")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cecae0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x8959b2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x4f314664, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EypBgNqV8vptqvLR.doc.rogue", cAlternateFileName="EYPBGN~1.ROG")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf7aa0, ftCreationTime.dwHighDateTime=0x1d5e0af, ftLastAccessTime.dwLowDateTime=0xbae41730, ftLastAccessTime.dwHighDateTime=0x1d5e930, ftLastWriteTime.dwLowDateTime=0x4f46bb92, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f5bZB0iH1SGyEIL.docx.rogue", cAlternateFileName="F5BZB0~1.ROG")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c48dc0, ftCreationTime.dwHighDateTime=0x1d5e3c2, ftLastAccessTime.dwLowDateTime=0xf1d51bb0, ftLastAccessTime.dwHighDateTime=0x1d5f0e5, ftLastWriteTime.dwLowDateTime=0xf1d51bb0, ftLastWriteTime.dwHighDateTime=0x1d5f0e5, nFileSizeHigh=0x0, nFileSizeLow=0x8847, dwReserved0=0x0, dwReserved1=0x0, cFileName="FjTbbvMtAYJ 1mWqf.swf", cAlternateFileName="FJTBBV~1.SWF")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a50d0, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0x26e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d5e89e, ftLastWriteTime.dwLowDateTime=0x4fcb334f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x30d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhCu9i52.avi.rogue", cAlternateFileName="GHCU9I~1.ROG")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe55d7df0, ftCreationTime.dwHighDateTime=0x1d5e46f, ftLastAccessTime.dwLowDateTime=0x246ab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e306, ftLastWriteTime.dwLowDateTime=0x4feef644, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1710, dwReserved0=0x0, dwReserved1=0x0, cFileName="GJ-ojKY.odt.rogue", cAlternateFileName="GJ-OJK~1.ROG")) returned 1 [0129.925] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe96150, ftCreationTime.dwHighDateTime=0x1d5eca9, ftLastAccessTime.dwLowDateTime=0x9f589610, ftLastAccessTime.dwHighDateTime=0x1d5e8e7, ftLastWriteTime.dwLowDateTime=0x9f589610, ftLastWriteTime.dwHighDateTime=0x1d5e8e7, nFileSizeHigh=0x0, nFileSizeLow=0x1666, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaeoIu-0Sm.flv", cAlternateFileName="IAEOIU~1.FLV")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc577ce0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0xbefeff0, ftLastAccessTime.dwHighDateTime=0x1d5eb07, ftLastWriteTime.dwLowDateTime=0xbefeff0, ftLastWriteTime.dwHighDateTime=0x1d5eb07, nFileSizeHigh=0x0, nFileSizeLow=0x9e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4W5dY_HMOXbAvF.gif", cAlternateFileName="K4W5DY~1.GIF")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe59140, ftCreationTime.dwHighDateTime=0x1d5e8ab, ftLastAccessTime.dwLowDateTime=0xf833f9f0, ftLastAccessTime.dwHighDateTime=0x1d5f030, ftLastWriteTime.dwLowDateTime=0xf833f9f0, ftLastWriteTime.dwHighDateTime=0x1d5f030, nFileSizeHigh=0x0, nFileSizeLow=0x940e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqG2EC.m4a", cAlternateFileName="")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4730cf20, ftCreationTime.dwHighDateTime=0x1d5e69e, ftLastAccessTime.dwLowDateTime=0xf8d9ba20, ftLastAccessTime.dwHighDateTime=0x1d5e97d, ftLastWriteTime.dwLowDateTime=0xf8d9ba20, ftLastWriteTime.dwHighDateTime=0x1d5e97d, nFileSizeHigh=0x0, nFileSizeLow=0xd3d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0WZNUp25FqquBgIY7M.ods", cAlternateFileName="M0WZNU~1.ODS")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198a030, ftCreationTime.dwHighDateTime=0x1d5e5ef, ftLastAccessTime.dwLowDateTime=0x44ced570, ftLastAccessTime.dwHighDateTime=0x1d5ed50, ftLastWriteTime.dwLowDateTime=0x44ced570, ftLastWriteTime.dwHighDateTime=0x1d5ed50, nFileSizeHigh=0x0, nFileSizeLow=0x14f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="m8QOvULxnziaWg.m4a", cAlternateFileName="M8QOVU~1.M4A")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8cfe60, ftCreationTime.dwHighDateTime=0x1d5e7f4, ftLastAccessTime.dwLowDateTime=0x8ca30b10, ftLastAccessTime.dwHighDateTime=0x1d5efa7, ftLastWriteTime.dwLowDateTime=0x50093287, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15360, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIF1LtAffQUPlp.doc.rogue", cAlternateFileName="NIF1LT~1.ROG")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950a300, ftCreationTime.dwHighDateTime=0x1d5f0cb, ftLastAccessTime.dwLowDateTime=0xeb420260, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xeb420260, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2qdaMi.wav", cAlternateFileName="")) returned 1 [0129.926] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec33970, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6603b4e0, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x506049b5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13900, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pek24XL WXFA3n65bg6t.avi.rogue", cAlternateFileName="PEK24X~1.ROG")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1cb5ef0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xab75a600, ftLastAccessTime.dwHighDateTime=0x1d5f0a2, ftLastWriteTime.dwLowDateTime=0x50866dc0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14d30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnMfbvrh.csv.rogue", cAlternateFileName="PNMFBV~1.ROG")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae978210, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xe16ab7b0, ftLastAccessTime.dwHighDateTime=0x1d5ea48, ftLastWriteTime.dwLowDateTime=0xe16ab7b0, ftLastWriteTime.dwHighDateTime=0x1d5ea48, nFileSizeHigh=0x0, nFileSizeLow=0x1045b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqn9NZY67Cdqj.ots", cAlternateFileName="QQN9NZ~1.OTS")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4415660, ftCreationTime.dwHighDateTime=0x1d5e968, ftLastAccessTime.dwLowDateTime=0xd74b0e00, ftLastAccessTime.dwHighDateTime=0x1d5f039, ftLastWriteTime.dwLowDateTime=0x50e5cd0a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa590, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCo0GuE3OXJRzFQ4kaPB.mp4.rogue", cAlternateFileName="RCO0GU~1.ROG")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8969b50, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x8b33a010, ftLastAccessTime.dwHighDateTime=0x1d5e484, ftLastWriteTime.dwLowDateTime=0x8b33a010, ftLastWriteTime.dwHighDateTime=0x1d5e484, nFileSizeHigh=0x0, nFileSizeLow=0xa113, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmj39_.m4a", cAlternateFileName="")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75aed30, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xa53e2ca0, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0x510007cb, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRzHs3YOcO Su 9Qp0T.mp3.rogue", cAlternateFileName="RRZHS3~1.ROG")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc246700, ftCreationTime.dwHighDateTime=0x1d5e448, ftLastAccessTime.dwLowDateTime=0x3f2206a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x3f2206a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xf9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSYVdWFpzDU.gif", cAlternateFileName="SSYVDW~1.GIF")) returned 1 [0129.927] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9d640, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0xa7c2a910, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0x511f04dd, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhJrCn1z8KsualV3.mp4.rogue", cAlternateFileName="VHJRCN~1.ROG")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5b6340, ftCreationTime.dwHighDateTime=0x1d5e819, ftLastAccessTime.dwLowDateTime=0x9aefc950, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x51774094, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5190, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOuJrZJUPXMR_VcGq.mp3.rogue", cAlternateFileName="VOUJRZ~1.ROG")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5e70, ftCreationTime.dwHighDateTime=0x1d5ef2b, ftLastAccessTime.dwLowDateTime=0x28e54490, ftLastAccessTime.dwHighDateTime=0x1d5e22c, ftLastWriteTime.dwLowDateTime=0x28e54490, ftLastWriteTime.dwHighDateTime=0x1d5e22c, nFileSizeHigh=0x0, nFileSizeLow=0xa207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VwGo72iqw.wav", cAlternateFileName="VWGO72~1.WAV")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df682d0, ftCreationTime.dwHighDateTime=0x1d5ec6f, ftLastAccessTime.dwLowDateTime=0x8925ac00, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x51bc6096, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUH_OX1ZBfpq-NsE.avi.rogue", cAlternateFileName="WUH_OX~1.ROG")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1774a980, ftCreationTime.dwHighDateTime=0x1d5e998, ftLastAccessTime.dwLowDateTime=0x8a322330, ftLastAccessTime.dwHighDateTime=0x1d5e5c4, ftLastWriteTime.dwLowDateTime=0x52385a0c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCczzh.mp3.rogue", cAlternateFileName="YCCZZH~1.ROG")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64928df0, ftCreationTime.dwHighDateTime=0x1d5eb68, ftLastAccessTime.dwLowDateTime=0x6e264a30, ftLastAccessTime.dwHighDateTime=0x1d5e228, ftLastWriteTime.dwLowDateTime=0x6e264a30, ftLastWriteTime.dwHighDateTime=0x1d5e228, nFileSizeHigh=0x0, nFileSizeLow=0xfe6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yq2iBy OgmaKpzop.gif", cAlternateFileName="YQ2IBY~1.GIF")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123678f0, ftCreationTime.dwHighDateTime=0x1d5e799, ftLastAccessTime.dwLowDateTime=0xd64d0950, ftLastAccessTime.dwHighDateTime=0x1d5f015, ftLastWriteTime.dwLowDateTime=0x52df3d98, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13190, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7J0cG9uHbZs.mp4.rogue", cAlternateFileName="Z7J0CG~1.ROG")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 1 [0129.928] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.929] FindClose (in: hFindFile=0x7a5fb68 | out: hFindFile=0x7a5fb68) returned 1 [0130.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0130.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0130.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0130.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0130.027] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0130.027] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52e1a13e, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x52e1a13e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fee8 [0130.027] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52e1a13e, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x52e1a13e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.028] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f28ef0, ftCreationTime.dwHighDateTime=0x1d5e3ee, ftLastAccessTime.dwLowDateTime=0x5f2be670, ftLastAccessTime.dwHighDateTime=0x1d5e6fb, ftLastWriteTime.dwLowDateTime=0x4db892ad, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xf2b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-E6vb.png.rogue", cAlternateFileName="-E6VBP~1.ROG")) returned 1 [0130.028] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-YQN_4ok", cAlternateFileName="")) returned 1 [0130.028] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527fc7e0, ftCreationTime.dwHighDateTime=0x1d5ed20, ftLastAccessTime.dwLowDateTime=0x69684850, ftLastAccessTime.dwHighDateTime=0x1d5e2a9, ftLastWriteTime.dwLowDateTime=0x69684850, ftLastWriteTime.dwHighDateTime=0x1d5e2a9, nFileSizeHigh=0x0, nFileSizeLow=0x3705, dwReserved0=0x0, dwReserved1=0x0, cFileName="0FxWXQvhHte.flv", cAlternateFileName="0FXWXQ~1.FLV")) returned 1 [0130.028] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6b39180, ftCreationTime.dwHighDateTime=0x1d5eb20, ftLastAccessTime.dwLowDateTime=0xd12b5a80, ftLastAccessTime.dwHighDateTime=0x1d5f010, ftLastWriteTime.dwLowDateTime=0xd12b5a80, ftLastWriteTime.dwHighDateTime=0x1d5f010, nFileSizeHigh=0x0, nFileSizeLow=0x14dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0n4ffGQfu yw.wav", cAlternateFileName="0N4FFG~1.WAV")) returned 1 [0130.029] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3835d140, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x64451630, ftLastAccessTime.dwHighDateTime=0x1d5e120, ftLastWriteTime.dwLowDateTime=0x64451630, ftLastWriteTime.dwHighDateTime=0x1d5e120, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x0, dwReserved1=0x0, cFileName="4tbjYPC2CtDfATrinO.flv", cAlternateFileName="4TBJYP~1.FLV")) returned 1 [0130.029] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc9fc510, ftCreationTime.dwHighDateTime=0x1d5e609, ftLastAccessTime.dwLowDateTime=0x7064acf0, ftLastAccessTime.dwHighDateTime=0x1d5e2e2, ftLastWriteTime.dwLowDateTime=0x7064acf0, ftLastWriteTime.dwHighDateTime=0x1d5e2e2, nFileSizeHigh=0x0, nFileSizeLow=0x70e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5PyHess87lIBo6JIW5aj.pps", cAlternateFileName="5PYHES~1.PPS")) returned 1 [0130.029] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde64a6a0, ftCreationTime.dwHighDateTime=0x1d5e2d4, ftLastAccessTime.dwLowDateTime=0x1b78bf40, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x4df519c0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Zi0ioEVH3f.jpg.rogue", cAlternateFileName="8ZI0IO~1.ROG")) returned 1 [0130.029] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf380, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc3b61c70, ftLastAccessTime.dwHighDateTime=0x1d5f08b, ftLastWriteTime.dwLowDateTime=0x4e643c8d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x6240, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlFSG6N2i2xrk.mp3.rogue", cAlternateFileName="ALFSG6~1.ROG")) returned 1 [0130.029] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfebd030, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xadad9e00, ftLastAccessTime.dwHighDateTime=0x1d5e1e3, ftLastWriteTime.dwLowDateTime=0x4eae25a0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xe210, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlMEPM.mkv.rogue", cAlternateFileName="ALMEPM~1.ROG")) returned 1 [0130.030] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bf33ef0, ftCreationTime.dwHighDateTime=0x1d5e463, ftLastAccessTime.dwLowDateTime=0xf9eb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xf9eb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0xab54, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOutOKzxVGxo6odR.flv", cAlternateFileName="BOUTOK~1.FLV")) returned 1 [0130.030] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x577c3040, ftCreationTime.dwHighDateTime=0x1d5e626, ftLastAccessTime.dwLowDateTime=0x133adaf0, ftLastAccessTime.dwHighDateTime=0x1d5f0ec, ftLastWriteTime.dwLowDateTime=0x4ecd23c6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cBErHk4e0egQ IF.mp4.rogue", cAlternateFileName="CBERHK~1.ROG")) returned 1 [0130.030] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f3e2e0, ftCreationTime.dwHighDateTime=0x1d5e2a2, ftLastAccessTime.dwLowDateTime=0x8d2bb1f0, ftLastAccessTime.dwHighDateTime=0x1d5e344, ftLastWriteTime.dwLowDateTime=0x4ef0e617, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xac40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cnp7ZWz4-nJIM8 C.jpg.rogue", cAlternateFileName="CNP7ZW~1.ROG")) returned 1 [0130.030] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b63f30, ftCreationTime.dwHighDateTime=0x1d5ec75, ftLastAccessTime.dwLowDateTime=0x260a6b60, ftLastAccessTime.dwHighDateTime=0x1d5f073, ftLastWriteTime.dwLowDateTime=0x4eff34f9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cY1wsK8aC.xlsx.rogue", cAlternateFileName="CY1WSK~1.ROG")) returned 1 [0130.030] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0130.031] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1814bd0, ftCreationTime.dwHighDateTime=0x1d5e6ab, ftLastAccessTime.dwLowDateTime=0x4b0668b0, ftLastAccessTime.dwHighDateTime=0x1d5ef24, ftLastWriteTime.dwLowDateTime=0x4b0668b0, ftLastWriteTime.dwHighDateTime=0x1d5ef24, nFileSizeHigh=0x0, nFileSizeLow=0x1106b, dwReserved0=0x0, dwReserved1=0x0, cFileName="dFMaAmn3-uq.wav", cAlternateFileName="DFMAAM~1.WAV")) returned 1 [0130.031] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4954dd0, ftCreationTime.dwHighDateTime=0x1d5ed0d, ftLastAccessTime.dwLowDateTime=0xa2d1380, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xa2d1380, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x10af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="E5-Yp.wav", cAlternateFileName="")) returned 1 [0130.031] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e443c30, ftCreationTime.dwHighDateTime=0x1d5e53f, ftLastAccessTime.dwLowDateTime=0x8156e4c0, ftLastAccessTime.dwHighDateTime=0x1d5e962, ftLastWriteTime.dwLowDateTime=0x4f170cf6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9410, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePeV1LzXYWIIRk7D.mp3.rogue", cAlternateFileName="EPEV1L~1.ROG")) returned 1 [0130.031] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cecae0, ftCreationTime.dwHighDateTime=0x1d5e0f5, ftLastAccessTime.dwLowDateTime=0x8959b2b0, ftLastAccessTime.dwHighDateTime=0x1d5e9e4, ftLastWriteTime.dwLowDateTime=0x4f314664, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EypBgNqV8vptqvLR.doc.rogue", cAlternateFileName="EYPBGN~1.ROG")) returned 1 [0130.032] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf7aa0, ftCreationTime.dwHighDateTime=0x1d5e0af, ftLastAccessTime.dwLowDateTime=0xbae41730, ftLastAccessTime.dwHighDateTime=0x1d5e930, ftLastWriteTime.dwLowDateTime=0x4f46bb92, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="f5bZB0iH1SGyEIL.docx.rogue", cAlternateFileName="F5BZB0~1.ROG")) returned 1 [0130.032] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c48dc0, ftCreationTime.dwHighDateTime=0x1d5e3c2, ftLastAccessTime.dwLowDateTime=0xf1d51bb0, ftLastAccessTime.dwHighDateTime=0x1d5f0e5, ftLastWriteTime.dwLowDateTime=0xf1d51bb0, ftLastWriteTime.dwHighDateTime=0x1d5f0e5, nFileSizeHigh=0x0, nFileSizeLow=0x8847, dwReserved0=0x0, dwReserved1=0x0, cFileName="FjTbbvMtAYJ 1mWqf.swf", cAlternateFileName="FJTBBV~1.SWF")) returned 1 [0130.032] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a50d0, ftCreationTime.dwHighDateTime=0x1d5f0e4, ftLastAccessTime.dwLowDateTime=0x26e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d5e89e, ftLastWriteTime.dwLowDateTime=0x4fcb334f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x30d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GhCu9i52.avi.rogue", cAlternateFileName="GHCU9I~1.ROG")) returned 1 [0130.032] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe55d7df0, ftCreationTime.dwHighDateTime=0x1d5e46f, ftLastAccessTime.dwLowDateTime=0x246ab6e0, ftLastAccessTime.dwHighDateTime=0x1d5e306, ftLastWriteTime.dwLowDateTime=0x4feef644, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1710, dwReserved0=0x0, dwReserved1=0x0, cFileName="GJ-ojKY.odt.rogue", cAlternateFileName="GJ-OJK~1.ROG")) returned 1 [0130.033] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe96150, ftCreationTime.dwHighDateTime=0x1d5eca9, ftLastAccessTime.dwLowDateTime=0x9f589610, ftLastAccessTime.dwHighDateTime=0x1d5e8e7, ftLastWriteTime.dwLowDateTime=0x9f589610, ftLastWriteTime.dwHighDateTime=0x1d5e8e7, nFileSizeHigh=0x0, nFileSizeLow=0x1666, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaeoIu-0Sm.flv", cAlternateFileName="IAEOIU~1.FLV")) returned 1 [0130.033] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc577ce0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0xbefeff0, ftLastAccessTime.dwHighDateTime=0x1d5eb07, ftLastWriteTime.dwLowDateTime=0xbefeff0, ftLastWriteTime.dwHighDateTime=0x1d5eb07, nFileSizeHigh=0x0, nFileSizeLow=0x9e8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="k4W5dY_HMOXbAvF.gif", cAlternateFileName="K4W5DY~1.GIF")) returned 1 [0130.033] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe59140, ftCreationTime.dwHighDateTime=0x1d5e8ab, ftLastAccessTime.dwLowDateTime=0xf833f9f0, ftLastAccessTime.dwHighDateTime=0x1d5f030, ftLastWriteTime.dwLowDateTime=0xf833f9f0, ftLastWriteTime.dwHighDateTime=0x1d5f030, nFileSizeHigh=0x0, nFileSizeLow=0x940e, dwReserved0=0x0, dwReserved1=0x0, cFileName="lqG2EC.m4a", cAlternateFileName="")) returned 1 [0130.033] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4730cf20, ftCreationTime.dwHighDateTime=0x1d5e69e, ftLastAccessTime.dwLowDateTime=0xf8d9ba20, ftLastAccessTime.dwHighDateTime=0x1d5e97d, ftLastWriteTime.dwLowDateTime=0xf8d9ba20, ftLastWriteTime.dwHighDateTime=0x1d5e97d, nFileSizeHigh=0x0, nFileSizeLow=0xd3d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0WZNUp25FqquBgIY7M.ods", cAlternateFileName="M0WZNU~1.ODS")) returned 1 [0130.033] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7198a030, ftCreationTime.dwHighDateTime=0x1d5e5ef, ftLastAccessTime.dwLowDateTime=0x44ced570, ftLastAccessTime.dwHighDateTime=0x1d5ed50, ftLastWriteTime.dwLowDateTime=0x44ced570, ftLastWriteTime.dwHighDateTime=0x1d5ed50, nFileSizeHigh=0x0, nFileSizeLow=0x14f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="m8QOvULxnziaWg.m4a", cAlternateFileName="M8QOVU~1.M4A")) returned 1 [0130.034] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c8cfe60, ftCreationTime.dwHighDateTime=0x1d5e7f4, ftLastAccessTime.dwLowDateTime=0x8ca30b10, ftLastAccessTime.dwHighDateTime=0x1d5efa7, ftLastWriteTime.dwLowDateTime=0x50093287, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15360, dwReserved0=0x0, dwReserved1=0x0, cFileName="nIF1LtAffQUPlp.doc.rogue", cAlternateFileName="NIF1LT~1.ROG")) returned 1 [0130.034] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1950a300, ftCreationTime.dwHighDateTime=0x1d5f0cb, ftLastAccessTime.dwLowDateTime=0xeb420260, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xeb420260, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11f8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="p2qdaMi.wav", cAlternateFileName="")) returned 1 [0130.034] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec33970, ftCreationTime.dwHighDateTime=0x1d5e7c0, ftLastAccessTime.dwLowDateTime=0x6603b4e0, ftLastAccessTime.dwHighDateTime=0x1d5e6ac, ftLastWriteTime.dwLowDateTime=0x506049b5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13900, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pek24XL WXFA3n65bg6t.avi.rogue", cAlternateFileName="PEK24X~1.ROG")) returned 1 [0130.034] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1cb5ef0, ftCreationTime.dwHighDateTime=0x1d5e376, ftLastAccessTime.dwLowDateTime=0xab75a600, ftLastAccessTime.dwHighDateTime=0x1d5f0a2, ftLastWriteTime.dwLowDateTime=0x50866dc0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14d30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnMfbvrh.csv.rogue", cAlternateFileName="PNMFBV~1.ROG")) returned 1 [0130.035] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae978210, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xe16ab7b0, ftLastAccessTime.dwHighDateTime=0x1d5ea48, ftLastWriteTime.dwLowDateTime=0xe16ab7b0, ftLastWriteTime.dwHighDateTime=0x1d5ea48, nFileSizeHigh=0x0, nFileSizeLow=0x1045b, dwReserved0=0x0, dwReserved1=0x0, cFileName="qqn9NZY67Cdqj.ots", cAlternateFileName="QQN9NZ~1.OTS")) returned 1 [0130.035] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4415660, ftCreationTime.dwHighDateTime=0x1d5e968, ftLastAccessTime.dwLowDateTime=0xd74b0e00, ftLastAccessTime.dwHighDateTime=0x1d5f039, ftLastWriteTime.dwLowDateTime=0x50e5cd0a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa590, dwReserved0=0x0, dwReserved1=0x0, cFileName="rCo0GuE3OXJRzFQ4kaPB.mp4.rogue", cAlternateFileName="RCO0GU~1.ROG")) returned 1 [0130.035] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8969b50, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x8b33a010, ftLastAccessTime.dwHighDateTime=0x1d5e484, ftLastWriteTime.dwLowDateTime=0x8b33a010, ftLastWriteTime.dwHighDateTime=0x1d5e484, nFileSizeHigh=0x0, nFileSizeLow=0xa113, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmj39_.m4a", cAlternateFileName="")) returned 1 [0130.035] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe75aed30, ftCreationTime.dwHighDateTime=0x1d5ea65, ftLastAccessTime.dwLowDateTime=0xa53e2ca0, ftLastAccessTime.dwHighDateTime=0x1d5e7e5, ftLastWriteTime.dwLowDateTime=0x510007cb, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RRzHs3YOcO Su 9Qp0T.mp3.rogue", cAlternateFileName="RRZHS3~1.ROG")) returned 1 [0130.036] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc246700, ftCreationTime.dwHighDateTime=0x1d5e448, ftLastAccessTime.dwLowDateTime=0x3f2206a0, ftLastAccessTime.dwHighDateTime=0x1d5e806, ftLastWriteTime.dwLowDateTime=0x3f2206a0, ftLastWriteTime.dwHighDateTime=0x1d5e806, nFileSizeHigh=0x0, nFileSizeLow=0xf9e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSYVdWFpzDU.gif", cAlternateFileName="SSYVDW~1.GIF")) returned 1 [0130.037] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fb9d640, ftCreationTime.dwHighDateTime=0x1d5e288, ftLastAccessTime.dwLowDateTime=0xa7c2a910, ftLastAccessTime.dwHighDateTime=0x1d5ef42, ftLastWriteTime.dwLowDateTime=0x511f04dd, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VhJrCn1z8KsualV3.mp4.rogue", cAlternateFileName="VHJRCN~1.ROG")) returned 1 [0130.038] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5b6340, ftCreationTime.dwHighDateTime=0x1d5e819, ftLastAccessTime.dwLowDateTime=0x9aefc950, ftLastAccessTime.dwHighDateTime=0x1d5e819, ftLastWriteTime.dwLowDateTime=0x51774094, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5190, dwReserved0=0x0, dwReserved1=0x0, cFileName="vOuJrZJUPXMR_VcGq.mp3.rogue", cAlternateFileName="VOUJRZ~1.ROG")) returned 1 [0130.038] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7df5e70, ftCreationTime.dwHighDateTime=0x1d5ef2b, ftLastAccessTime.dwLowDateTime=0x28e54490, ftLastAccessTime.dwHighDateTime=0x1d5e22c, ftLastWriteTime.dwLowDateTime=0x28e54490, ftLastWriteTime.dwHighDateTime=0x1d5e22c, nFileSizeHigh=0x0, nFileSizeLow=0xa207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VwGo72iqw.wav", cAlternateFileName="VWGO72~1.WAV")) returned 1 [0130.038] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df682d0, ftCreationTime.dwHighDateTime=0x1d5ec6f, ftLastAccessTime.dwLowDateTime=0x8925ac00, ftLastAccessTime.dwHighDateTime=0x1d5e713, ftLastWriteTime.dwLowDateTime=0x51bc6096, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1010, dwReserved0=0x0, dwReserved1=0x0, cFileName="wUH_OX1ZBfpq-NsE.avi.rogue", cAlternateFileName="WUH_OX~1.ROG")) returned 1 [0130.043] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1774a980, ftCreationTime.dwHighDateTime=0x1d5e998, ftLastAccessTime.dwLowDateTime=0x8a322330, ftLastAccessTime.dwHighDateTime=0x1d5e5c4, ftLastWriteTime.dwLowDateTime=0x52385a0c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15b40, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCczzh.mp3.rogue", cAlternateFileName="YCCZZH~1.ROG")) returned 1 [0130.043] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64928df0, ftCreationTime.dwHighDateTime=0x1d5eb68, ftLastAccessTime.dwLowDateTime=0x6e264a30, ftLastAccessTime.dwHighDateTime=0x1d5e228, ftLastWriteTime.dwLowDateTime=0x6e264a30, ftLastWriteTime.dwHighDateTime=0x1d5e228, nFileSizeHigh=0x0, nFileSizeLow=0xfe6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yq2iBy OgmaKpzop.gif", cAlternateFileName="YQ2IBY~1.GIF")) returned 1 [0130.044] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123678f0, ftCreationTime.dwHighDateTime=0x1d5e799, ftLastAccessTime.dwLowDateTime=0xd64d0950, ftLastAccessTime.dwHighDateTime=0x1d5f015, ftLastWriteTime.dwLowDateTime=0x52df3d98, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13190, dwReserved0=0x0, dwReserved1=0x0, cFileName="z7J0cG9uHbZs.mp4.rogue", cAlternateFileName="Z7J0CG~1.ROG")) returned 1 [0130.044] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 1 [0130.044] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x386593c0, ftCreationTime.dwHighDateTime=0x1d5ed08, ftLastAccessTime.dwLowDateTime=0x52ab3cf0, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x52ab3cf0, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0xccbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZbSEIF4KMC0A0RcoZSjE.flv", cAlternateFileName="ZBSEIF~1.FLV")) returned 0 [0130.044] FindClose (in: hFindFile=0x7a5fee8 | out: hFindFile=0x7a5fee8) returned 1 [0130.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0130.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0130.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0130.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0130.045] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x21, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", lpFilePart=0x0) returned 0x20 [0130.045] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9e8 [0130.045] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.045] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285c9e10, ftCreationTime.dwHighDateTime=0x1d5ec68, ftLastAccessTime.dwLowDateTime=0xa5c9dff0, ftLastAccessTime.dwHighDateTime=0x1d5ea58, ftLastWriteTime.dwLowDateTime=0x5326d609, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxyVMo6BxgALnPs.bmp.rogue", cAlternateFileName="CXYVMO~1.ROG")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3407d060, ftCreationTime.dwHighDateTime=0x1d5ed33, ftLastAccessTime.dwLowDateTime=0xa43b7710, ftLastAccessTime.dwHighDateTime=0x1d5e41e, ftLastWriteTime.dwLowDateTime=0xa43b7710, ftLastWriteTime.dwHighDateTime=0x1d5e41e, nFileSizeHigh=0x0, nFileSizeLow=0xee9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e801hOBrDr.gif", cAlternateFileName="E801HO~1.GIF")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45650800, ftCreationTime.dwHighDateTime=0x1d5ebfd, ftLastAccessTime.dwLowDateTime=0xd54d4490, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0x5384c3c7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXogTPXi9b7b.bmp.rogue", cAlternateFileName="GXOGTP~1.ROG")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7db3400, ftCreationTime.dwHighDateTime=0x1d5ef37, ftLastAccessTime.dwLowDateTime=0x4f17de50, ftLastAccessTime.dwHighDateTime=0x1d5eb6b, ftLastWriteTime.dwLowDateTime=0x541cfc40, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HyN88W3lv0C.xls.rogue", cAlternateFileName="HYN88W~1.ROG")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1fe2c0, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x1ca7d420, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0x54cd6bd3, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Me3a.jpg.rogue", cAlternateFileName="ME3AJP~1.ROG")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d43d0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0xb0a55ae0, ftLastAccessTime.dwHighDateTime=0x1d5ea8e, ftLastWriteTime.dwLowDateTime=0x54f5f4b9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOQshVhma.rtf.rogue", cAlternateFileName="TOQSHV~1.ROG")) returned 1 [0130.046] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3.rogue", cAlternateFileName="XHURU1~1.ROG")) returned 1 [0130.047] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.047] FindClose (in: hFindFile=0x7a5f9e8 | out: hFindFile=0x7a5f9e8) returned 1 [0130.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0130.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0130.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0130.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x21 [0130.047] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", nBufferLength=0x21, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok", lpFilePart=0x0) returned 0x20 [0130.047] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-YQN_4ok\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd68 [0130.048] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe75da020, ftCreationTime.dwHighDateTime=0x1d5efa6, ftLastAccessTime.dwLowDateTime=0x550dcba5, ftLastAccessTime.dwHighDateTime=0x1d61763, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.048] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285c9e10, ftCreationTime.dwHighDateTime=0x1d5ec68, ftLastAccessTime.dwLowDateTime=0xa5c9dff0, ftLastAccessTime.dwHighDateTime=0x1d5ea58, ftLastWriteTime.dwLowDateTime=0x5326d609, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxyVMo6BxgALnPs.bmp.rogue", cAlternateFileName="CXYVMO~1.ROG")) returned 1 [0130.048] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3407d060, ftCreationTime.dwHighDateTime=0x1d5ed33, ftLastAccessTime.dwLowDateTime=0xa43b7710, ftLastAccessTime.dwHighDateTime=0x1d5e41e, ftLastWriteTime.dwLowDateTime=0xa43b7710, ftLastWriteTime.dwHighDateTime=0x1d5e41e, nFileSizeHigh=0x0, nFileSizeLow=0xee9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="e801hOBrDr.gif", cAlternateFileName="E801HO~1.GIF")) returned 1 [0130.048] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45650800, ftCreationTime.dwHighDateTime=0x1d5ebfd, ftLastAccessTime.dwLowDateTime=0xd54d4490, ftLastAccessTime.dwHighDateTime=0x1d5e6a9, ftLastWriteTime.dwLowDateTime=0x5384c3c7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXogTPXi9b7b.bmp.rogue", cAlternateFileName="GXOGTP~1.ROG")) returned 1 [0130.048] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7db3400, ftCreationTime.dwHighDateTime=0x1d5ef37, ftLastAccessTime.dwLowDateTime=0x4f17de50, ftLastAccessTime.dwHighDateTime=0x1d5eb6b, ftLastWriteTime.dwLowDateTime=0x541cfc40, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x68e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HyN88W3lv0C.xls.rogue", cAlternateFileName="HYN88W~1.ROG")) returned 1 [0130.049] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1fe2c0, ftCreationTime.dwHighDateTime=0x1d5ead0, ftLastAccessTime.dwLowDateTime=0x1ca7d420, ftLastAccessTime.dwHighDateTime=0x1d5e521, ftLastWriteTime.dwLowDateTime=0x54cd6bd3, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16380, dwReserved0=0x0, dwReserved1=0x0, cFileName="Me3a.jpg.rogue", cAlternateFileName="ME3AJP~1.ROG")) returned 1 [0130.049] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d43d0, ftCreationTime.dwHighDateTime=0x1d5ee21, ftLastAccessTime.dwLowDateTime=0xb0a55ae0, ftLastAccessTime.dwHighDateTime=0x1d5ea8e, ftLastWriteTime.dwLowDateTime=0x54f5f4b9, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="tOQshVhma.rtf.rogue", cAlternateFileName="TOQSHV~1.ROG")) returned 1 [0130.049] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3.rogue", cAlternateFileName="XHURU1~1.ROG")) returned 1 [0130.049] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x682f80a0, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xf31067a0, ftLastAccessTime.dwHighDateTime=0x1d5e8de, ftLastWriteTime.dwLowDateTime=0x550dcba5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XHuRU100Aeb4.mp3.rogue", cAlternateFileName="XHURU1~1.ROG")) returned 0 [0130.049] FindClose (in: hFindFile=0x7a5fd68 | out: hFindFile=0x7a5fd68) returned 1 [0130.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0130.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0130.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0130.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0130.050] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0130.050] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe89ec3e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe89ec3e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fca8 [0130.050] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe89ec3e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe89ec3e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.050] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1515a5f0, ftCreationTime.dwHighDateTime=0x1d56ef9, ftLastAccessTime.dwLowDateTime=0xa2ddbe30, ftLastAccessTime.dwHighDateTime=0x1d5b37e, ftLastWriteTime.dwLowDateTime=0xa2ddbe30, ftLastWriteTime.dwHighDateTime=0x1d5b37e, nFileSizeHigh=0x0, nFileSizeLow=0x13ea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-f m.xlsx", cAlternateFileName="-FM~1.XLS")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f6d280, ftCreationTime.dwHighDateTime=0x1d5ef09, ftLastAccessTime.dwLowDateTime=0xe397610, ftLastAccessTime.dwHighDateTime=0x1d5f07e, ftLastWriteTime.dwLowDateTime=0xe397610, ftLastWriteTime.dwHighDateTime=0x1d5f07e, nFileSizeHigh=0x0, nFileSizeLow=0x9d66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5kPCiHwh78u2.ods", cAlternateFileName="5KPCIH~1.ODS")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c5c40, ftCreationTime.dwHighDateTime=0x1d59379, ftLastAccessTime.dwLowDateTime=0x5530c120, ftLastAccessTime.dwHighDateTime=0x1d5b3c7, ftLastWriteTime.dwLowDateTime=0x5530c120, ftLastWriteTime.dwHighDateTime=0x1d5b3c7, nFileSizeHigh=0x0, nFileSizeLow=0x1007f, dwReserved0=0x0, dwReserved1=0x0, cFileName="7cDyn2PxDXLZE0jXlwu.xlsx", cAlternateFileName="7CDYN2~1.XLS")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433d0e80, ftCreationTime.dwHighDateTime=0x1d5ed27, ftLastAccessTime.dwLowDateTime=0xefcf2670, ftLastAccessTime.dwHighDateTime=0x1d5a51e, ftLastWriteTime.dwLowDateTime=0xefcf2670, ftLastWriteTime.dwHighDateTime=0x1d5a51e, nFileSizeHigh=0x0, nFileSizeLow=0x1237c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7g-BfoX.pptx", cAlternateFileName="7G-BFO~1.PPT")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29456200, ftCreationTime.dwHighDateTime=0x1d5e8e7, ftLastAccessTime.dwLowDateTime=0xb5a6b040, ftLastAccessTime.dwHighDateTime=0x1d599dd, ftLastWriteTime.dwLowDateTime=0xb5a6b040, ftLastWriteTime.dwHighDateTime=0x1d599dd, nFileSizeHigh=0x0, nFileSizeLow=0x4e8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bb4-2.pptx", cAlternateFileName="BB4-2~1.PPT")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8567920, ftCreationTime.dwHighDateTime=0x1d5707f, ftLastAccessTime.dwLowDateTime=0xd353e0a0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0xd353e0a0, ftLastWriteTime.dwHighDateTime=0x1d5efe0, nFileSizeHigh=0x0, nFileSizeLow=0x3e54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BfqZ6TqUSw0w2pEAmt.docx", cAlternateFileName="BFQZ6T~1.DOC")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BqTxvblrfPL pjZQxG", cAlternateFileName="BQTXVB~1")) returned 1 [0130.051] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc47300, ftCreationTime.dwHighDateTime=0x1d56a1b, ftLastAccessTime.dwLowDateTime=0x9a0961f0, ftLastAccessTime.dwHighDateTime=0x1d5706d, ftLastWriteTime.dwLowDateTime=0x9a0961f0, ftLastWriteTime.dwHighDateTime=0x1d5706d, nFileSizeHigh=0x0, nFileSizeLow=0x16ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2x9noGuNaY1.xlsx", cAlternateFileName="D2X9NO~1.XLS")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15140bf0, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xad2321d0, ftLastAccessTime.dwHighDateTime=0x1d5a70a, ftLastWriteTime.dwLowDateTime=0xad2321d0, ftLastWriteTime.dwHighDateTime=0x1d5a70a, nFileSizeHigh=0x0, nFileSizeLow=0x17e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZZs02.pptx", cAlternateFileName="EZZS02~1.PPT")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ade4a0, ftCreationTime.dwHighDateTime=0x1d5f005, ftLastAccessTime.dwLowDateTime=0x8e89b570, ftLastAccessTime.dwHighDateTime=0x1d5e951, ftLastWriteTime.dwLowDateTime=0x8e89b570, ftLastWriteTime.dwHighDateTime=0x1d5e951, nFileSizeHigh=0x0, nFileSizeLow=0xc5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="H3g 5cNASDx.pptx", cAlternateFileName="H3G5CN~1.PPT")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ade56d0, ftCreationTime.dwHighDateTime=0x1d5a3b4, ftLastAccessTime.dwLowDateTime=0xcb0d9f10, ftLastAccessTime.dwHighDateTime=0x1d5b4dc, ftLastWriteTime.dwLowDateTime=0xcb0d9f10, ftLastWriteTime.dwHighDateTime=0x1d5b4dc, nFileSizeHigh=0x0, nFileSizeLow=0x103a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="H6VCA.docx", cAlternateFileName="H6VCA~1.DOC")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5dd68e0, ftCreationTime.dwHighDateTime=0x1d5e433, ftLastAccessTime.dwLowDateTime=0x5a350590, ftLastAccessTime.dwHighDateTime=0x1d5e0be, ftLastWriteTime.dwLowDateTime=0x5a350590, ftLastWriteTime.dwHighDateTime=0x1d5e0be, nFileSizeHigh=0x0, nFileSizeLow=0x892b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrWiIJF2Yi3.ots", cAlternateFileName="HRWIIJ~1.OTS")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2b5540, ftCreationTime.dwHighDateTime=0x1d5c872, ftLastAccessTime.dwLowDateTime=0x76b41c10, ftLastAccessTime.dwHighDateTime=0x1d59bc7, ftLastWriteTime.dwLowDateTime=0x76b41c10, ftLastWriteTime.dwHighDateTime=0x1d59bc7, nFileSizeHigh=0x0, nFileSizeLow=0xc4db, dwReserved0=0x0, dwReserved1=0x0, cFileName="LDmyBv.xlsx", cAlternateFileName="LDMYBV~1.XLS")) returned 1 [0130.052] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a7bcc0, ftCreationTime.dwHighDateTime=0x1d5e220, ftLastAccessTime.dwLowDateTime=0x996dd0a0, ftLastAccessTime.dwHighDateTime=0x1d5719e, ftLastWriteTime.dwLowDateTime=0x996dd0a0, ftLastWriteTime.dwHighDateTime=0x1d5719e, nFileSizeHigh=0x0, nFileSizeLow=0xf68a, dwReserved0=0x0, dwReserved1=0x0, cFileName="lYSDfY7uDY7.docx", cAlternateFileName="LYSDFY~1.DOC")) returned 1 [0130.053] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0130.053] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0130.053] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0130.053] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0130.053] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc3c7a0, ftCreationTime.dwHighDateTime=0x1d5eec0, ftLastAccessTime.dwLowDateTime=0xc52134a0, ftLastAccessTime.dwHighDateTime=0x1d5d862, ftLastWriteTime.dwLowDateTime=0xc52134a0, ftLastWriteTime.dwHighDateTime=0x1d5d862, nFileSizeHigh=0x0, nFileSizeLow=0x182ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nWNPjKQf-qVoIznJvQS.docx", cAlternateFileName="NWNPJK~1.DOC")) returned 1 [0130.054] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0130.081] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56cb3b0, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x76907f90, ftLastAccessTime.dwHighDateTime=0x1d5b1a1, ftLastWriteTime.dwLowDateTime=0x76907f90, ftLastWriteTime.dwHighDateTime=0x1d5b1a1, nFileSizeHigh=0x0, nFileSizeLow=0x50ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="p664f5.pptx", cAlternateFileName="P664F5~1.PPT")) returned 1 [0130.081] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a23df70, ftCreationTime.dwHighDateTime=0x1d5eed2, ftLastAccessTime.dwLowDateTime=0x5a16b7b0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0x5a16b7b0, ftLastWriteTime.dwHighDateTime=0x1d5e2f9, nFileSizeHigh=0x0, nFileSizeLow=0x9773, dwReserved0=0x0, dwReserved1=0x0, cFileName="qKfB ARuH.csv", cAlternateFileName="QKFBAR~1.CSV")) returned 1 [0130.081] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rv_0", cAlternateFileName="")) returned 1 [0130.081] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc9dfe0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0xcfb23a30, ftLastAccessTime.dwHighDateTime=0x1d5ecfe, ftLastWriteTime.dwLowDateTime=0xcfb23a30, ftLastWriteTime.dwHighDateTime=0x1d5ecfe, nFileSizeHigh=0x0, nFileSizeLow=0xc21a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAUR7N6xUH7J.xls", cAlternateFileName="SAUR7N~1.XLS")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f1da00, ftCreationTime.dwHighDateTime=0x1d57891, ftLastAccessTime.dwLowDateTime=0xe8e0dad0, ftLastAccessTime.dwHighDateTime=0x1d5b729, ftLastWriteTime.dwLowDateTime=0xe8e0dad0, ftLastWriteTime.dwHighDateTime=0x1d5b729, nFileSizeHigh=0x0, nFileSizeLow=0xb8c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq aNg0bkUlKXeGtKnb.xlsx", cAlternateFileName="TQANG0~1.XLS")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96251490, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xba468320, ftLastAccessTime.dwHighDateTime=0x1d5eecc, ftLastWriteTime.dwLowDateTime=0xba468320, ftLastWriteTime.dwHighDateTime=0x1d5eecc, nFileSizeHigh=0x0, nFileSizeLow=0x169e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZZsUQDWRt.pps", cAlternateFileName="TZZSUQ~1.PPS")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc3a5f0, ftCreationTime.dwHighDateTime=0x1d564e3, ftLastAccessTime.dwLowDateTime=0x6a679280, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0x6a679280, ftLastWriteTime.dwHighDateTime=0x1d5e23e, nFileSizeHigh=0x0, nFileSizeLow=0x88d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViQeivsJY.docx", cAlternateFileName="VIQEIV~1.DOC")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cb0d3b0, ftCreationTime.dwHighDateTime=0x1d58114, ftLastAccessTime.dwLowDateTime=0x3d016910, ftLastAccessTime.dwHighDateTime=0x1d591ad, ftLastWriteTime.dwLowDateTime=0x3d016910, ftLastWriteTime.dwHighDateTime=0x1d591ad, nFileSizeHigh=0x0, nFileSizeLow=0x10d0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VYAJ0YGY4ioh3.pptx", cAlternateFileName="VYAJ0Y~1.PPT")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ceed70, ftCreationTime.dwHighDateTime=0x1d5e635, ftLastAccessTime.dwLowDateTime=0x4b408850, ftLastAccessTime.dwHighDateTime=0x1d5ea3e, ftLastWriteTime.dwLowDateTime=0x4b408850, ftLastWriteTime.dwHighDateTime=0x1d5ea3e, nFileSizeHigh=0x0, nFileSizeLow=0x5059, dwReserved0=0x0, dwReserved1=0x0, cFileName="WySPEe2.ots", cAlternateFileName="")) returned 1 [0130.082] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0130.082] FindClose (in: hFindFile=0x7a5fca8 | out: hFindFile=0x7a5fca8) returned 1 [0130.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0130.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0130.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0130.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0130.083] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0130.083] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe89ec3e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe89ec3e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fea8 [0130.083] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe89ec3e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe89ec3e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0130.083] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1515a5f0, ftCreationTime.dwHighDateTime=0x1d56ef9, ftLastAccessTime.dwLowDateTime=0xa2ddbe30, ftLastAccessTime.dwHighDateTime=0x1d5b37e, ftLastWriteTime.dwLowDateTime=0xa2ddbe30, ftLastWriteTime.dwHighDateTime=0x1d5b37e, nFileSizeHigh=0x0, nFileSizeLow=0x13ea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="-f m.xlsx", cAlternateFileName="-FM~1.XLS")) returned 1 [0130.083] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5f6d280, ftCreationTime.dwHighDateTime=0x1d5ef09, ftLastAccessTime.dwLowDateTime=0xe397610, ftLastAccessTime.dwHighDateTime=0x1d5f07e, ftLastWriteTime.dwLowDateTime=0xe397610, ftLastWriteTime.dwHighDateTime=0x1d5f07e, nFileSizeHigh=0x0, nFileSizeLow=0x9d66, dwReserved0=0x0, dwReserved1=0x0, cFileName="5kPCiHwh78u2.ods", cAlternateFileName="5KPCIH~1.ODS")) returned 1 [0130.083] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c5c40, ftCreationTime.dwHighDateTime=0x1d59379, ftLastAccessTime.dwLowDateTime=0x5530c120, ftLastAccessTime.dwHighDateTime=0x1d5b3c7, ftLastWriteTime.dwLowDateTime=0x5530c120, ftLastWriteTime.dwHighDateTime=0x1d5b3c7, nFileSizeHigh=0x0, nFileSizeLow=0x1007f, dwReserved0=0x0, dwReserved1=0x0, cFileName="7cDyn2PxDXLZE0jXlwu.xlsx", cAlternateFileName="7CDYN2~1.XLS")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433d0e80, ftCreationTime.dwHighDateTime=0x1d5ed27, ftLastAccessTime.dwLowDateTime=0xefcf2670, ftLastAccessTime.dwHighDateTime=0x1d5a51e, ftLastWriteTime.dwLowDateTime=0xefcf2670, ftLastWriteTime.dwHighDateTime=0x1d5a51e, nFileSizeHigh=0x0, nFileSizeLow=0x1237c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7g-BfoX.pptx", cAlternateFileName="7G-BFO~1.PPT")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29456200, ftCreationTime.dwHighDateTime=0x1d5e8e7, ftLastAccessTime.dwLowDateTime=0xb5a6b040, ftLastAccessTime.dwHighDateTime=0x1d599dd, ftLastWriteTime.dwLowDateTime=0xb5a6b040, ftLastWriteTime.dwHighDateTime=0x1d599dd, nFileSizeHigh=0x0, nFileSizeLow=0x4e8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bb4-2.pptx", cAlternateFileName="BB4-2~1.PPT")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8567920, ftCreationTime.dwHighDateTime=0x1d5707f, ftLastAccessTime.dwLowDateTime=0xd353e0a0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0xd353e0a0, ftLastWriteTime.dwHighDateTime=0x1d5efe0, nFileSizeHigh=0x0, nFileSizeLow=0x3e54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BfqZ6TqUSw0w2pEAmt.docx", cAlternateFileName="BFQZ6T~1.DOC")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BqTxvblrfPL pjZQxG", cAlternateFileName="BQTXVB~1")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc47300, ftCreationTime.dwHighDateTime=0x1d56a1b, ftLastAccessTime.dwLowDateTime=0x9a0961f0, ftLastAccessTime.dwHighDateTime=0x1d5706d, ftLastWriteTime.dwLowDateTime=0x9a0961f0, ftLastWriteTime.dwHighDateTime=0x1d5706d, nFileSizeHigh=0x0, nFileSizeLow=0x16ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="D2x9noGuNaY1.xlsx", cAlternateFileName="D2X9NO~1.XLS")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0130.084] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15140bf0, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xad2321d0, ftLastAccessTime.dwHighDateTime=0x1d5a70a, ftLastWriteTime.dwLowDateTime=0xad2321d0, ftLastWriteTime.dwHighDateTime=0x1d5a70a, nFileSizeHigh=0x0, nFileSizeLow=0x17e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="eZZs02.pptx", cAlternateFileName="EZZS02~1.PPT")) returned 1 [0130.085] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ade4a0, ftCreationTime.dwHighDateTime=0x1d5f005, ftLastAccessTime.dwLowDateTime=0x8e89b570, ftLastAccessTime.dwHighDateTime=0x1d5e951, ftLastWriteTime.dwLowDateTime=0x8e89b570, ftLastWriteTime.dwHighDateTime=0x1d5e951, nFileSizeHigh=0x0, nFileSizeLow=0xc5f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="H3g 5cNASDx.pptx", cAlternateFileName="H3G5CN~1.PPT")) returned 1 [0130.085] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ade56d0, ftCreationTime.dwHighDateTime=0x1d5a3b4, ftLastAccessTime.dwLowDateTime=0xcb0d9f10, ftLastAccessTime.dwHighDateTime=0x1d5b4dc, ftLastWriteTime.dwLowDateTime=0xcb0d9f10, ftLastWriteTime.dwHighDateTime=0x1d5b4dc, nFileSizeHigh=0x0, nFileSizeLow=0x103a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="H6VCA.docx", cAlternateFileName="H6VCA~1.DOC")) returned 1 [0130.085] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5dd68e0, ftCreationTime.dwHighDateTime=0x1d5e433, ftLastAccessTime.dwLowDateTime=0x5a350590, ftLastAccessTime.dwHighDateTime=0x1d5e0be, ftLastWriteTime.dwLowDateTime=0x5a350590, ftLastWriteTime.dwHighDateTime=0x1d5e0be, nFileSizeHigh=0x0, nFileSizeLow=0x892b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrWiIJF2Yi3.ots", cAlternateFileName="HRWIIJ~1.OTS")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2b5540, ftCreationTime.dwHighDateTime=0x1d5c872, ftLastAccessTime.dwLowDateTime=0x76b41c10, ftLastAccessTime.dwHighDateTime=0x1d59bc7, ftLastWriteTime.dwLowDateTime=0x76b41c10, ftLastWriteTime.dwHighDateTime=0x1d59bc7, nFileSizeHigh=0x0, nFileSizeLow=0xc4db, dwReserved0=0x0, dwReserved1=0x0, cFileName="LDmyBv.xlsx", cAlternateFileName="LDMYBV~1.XLS")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a7bcc0, ftCreationTime.dwHighDateTime=0x1d5e220, ftLastAccessTime.dwLowDateTime=0x996dd0a0, ftLastAccessTime.dwHighDateTime=0x1d5719e, ftLastWriteTime.dwLowDateTime=0x996dd0a0, ftLastWriteTime.dwHighDateTime=0x1d5719e, nFileSizeHigh=0x0, nFileSizeLow=0xf68a, dwReserved0=0x0, dwReserved1=0x0, cFileName="lYSDfY7uDY7.docx", cAlternateFileName="LYSDFY~1.DOC")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc3c7a0, ftCreationTime.dwHighDateTime=0x1d5eec0, ftLastAccessTime.dwLowDateTime=0xc52134a0, ftLastAccessTime.dwHighDateTime=0x1d5d862, ftLastWriteTime.dwLowDateTime=0xc52134a0, ftLastWriteTime.dwHighDateTime=0x1d5d862, nFileSizeHigh=0x0, nFileSizeLow=0x182ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="nWNPjKQf-qVoIznJvQS.docx", cAlternateFileName="NWNPJK~1.DOC")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0130.086] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56cb3b0, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x76907f90, ftLastAccessTime.dwHighDateTime=0x1d5b1a1, ftLastWriteTime.dwLowDateTime=0x76907f90, ftLastWriteTime.dwHighDateTime=0x1d5b1a1, nFileSizeHigh=0x0, nFileSizeLow=0x50ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="p664f5.pptx", cAlternateFileName="P664F5~1.PPT")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a23df70, ftCreationTime.dwHighDateTime=0x1d5eed2, ftLastAccessTime.dwLowDateTime=0x5a16b7b0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0x5a16b7b0, ftLastWriteTime.dwHighDateTime=0x1d5e2f9, nFileSizeHigh=0x0, nFileSizeLow=0x9773, dwReserved0=0x0, dwReserved1=0x0, cFileName="qKfB ARuH.csv", cAlternateFileName="QKFBAR~1.CSV")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rv_0", cAlternateFileName="")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc9dfe0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0xcfb23a30, ftLastAccessTime.dwHighDateTime=0x1d5ecfe, ftLastWriteTime.dwLowDateTime=0xcfb23a30, ftLastWriteTime.dwHighDateTime=0x1d5ecfe, nFileSizeHigh=0x0, nFileSizeLow=0xc21a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAUR7N6xUH7J.xls", cAlternateFileName="SAUR7N~1.XLS")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f1da00, ftCreationTime.dwHighDateTime=0x1d57891, ftLastAccessTime.dwLowDateTime=0xe8e0dad0, ftLastAccessTime.dwHighDateTime=0x1d5b729, ftLastWriteTime.dwLowDateTime=0xe8e0dad0, ftLastWriteTime.dwHighDateTime=0x1d5b729, nFileSizeHigh=0x0, nFileSizeLow=0xb8c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq aNg0bkUlKXeGtKnb.xlsx", cAlternateFileName="TQANG0~1.XLS")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96251490, ftCreationTime.dwHighDateTime=0x1d5ea0b, ftLastAccessTime.dwLowDateTime=0xba468320, ftLastAccessTime.dwHighDateTime=0x1d5eecc, ftLastWriteTime.dwLowDateTime=0xba468320, ftLastWriteTime.dwHighDateTime=0x1d5eecc, nFileSizeHigh=0x0, nFileSizeLow=0x169e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TZZsUQDWRt.pps", cAlternateFileName="TZZSUQ~1.PPS")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc3a5f0, ftCreationTime.dwHighDateTime=0x1d564e3, ftLastAccessTime.dwLowDateTime=0x6a679280, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0x6a679280, ftLastWriteTime.dwHighDateTime=0x1d5e23e, nFileSizeHigh=0x0, nFileSizeLow=0x88d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViQeivsJY.docx", cAlternateFileName="VIQEIV~1.DOC")) returned 1 [0130.087] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cb0d3b0, ftCreationTime.dwHighDateTime=0x1d58114, ftLastAccessTime.dwLowDateTime=0x3d016910, ftLastAccessTime.dwHighDateTime=0x1d591ad, ftLastWriteTime.dwLowDateTime=0x3d016910, ftLastWriteTime.dwHighDateTime=0x1d591ad, nFileSizeHigh=0x0, nFileSizeLow=0x10d0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VYAJ0YGY4ioh3.pptx", cAlternateFileName="VYAJ0Y~1.PPT")) returned 1 [0130.088] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ceed70, ftCreationTime.dwHighDateTime=0x1d5e635, ftLastAccessTime.dwLowDateTime=0x4b408850, ftLastAccessTime.dwHighDateTime=0x1d5ea3e, ftLastWriteTime.dwLowDateTime=0x4b408850, ftLastWriteTime.dwHighDateTime=0x1d5ea3e, nFileSizeHigh=0x0, nFileSizeLow=0x5059, dwReserved0=0x0, dwReserved1=0x0, cFileName="WySPEe2.ots", cAlternateFileName="")) returned 1 [0130.088] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ceed70, ftCreationTime.dwHighDateTime=0x1d5e635, ftLastAccessTime.dwLowDateTime=0x4b408850, ftLastAccessTime.dwHighDateTime=0x1d5ea3e, ftLastWriteTime.dwLowDateTime=0x4b408850, ftLastWriteTime.dwHighDateTime=0x1d5ea3e, nFileSizeHigh=0x0, nFileSizeLow=0x5059, dwReserved0=0x0, dwReserved1=0x0, cFileName="WySPEe2.ots", cAlternateFileName="")) returned 0 [0130.088] FindClose (in: hFindFile=0x7a5fea8 | out: hFindFile=0x7a5fea8) returned 1 [0130.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0130.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0130.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0130.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", lpFilePart=0x0) returned 0x23 [0130.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0130.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-f m.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0130.089] GetFileType (hFile=0x2e0) returned 0x1 [0130.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0130.089] GetFileType (hFile=0x2e0) returned 0x1 [0130.089] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x13ea7 [0130.089] ReadFile (in: hFile=0x2e0, lpBuffer=0x2837500, nNumberOfBytesToRead=0x13ea7, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2837500*, lpNumberOfBytesRead=0x8fec60*=0x13ea7, lpOverlapped=0x0) returned 1 [0130.091] CloseHandle (hObject=0x2e0) returned 1 [0130.335] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0130.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0130.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0130.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0130.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0130.336] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", lpFilePart=0x0) returned 0x23 [0130.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0130.336] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-f m.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0130.338] GetFileType (hFile=0x2e0) returned 0x1 [0130.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0130.338] GetFileType (hFile=0x2e0) returned 0x1 [0130.338] WriteFile (in: hFile=0x2e0, lpBuffer=0x28bff10*, nNumberOfBytesToWrite=0x13eb0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28bff10*, lpNumberOfBytesWritten=0x8fec54*=0x13eb0, lpOverlapped=0x0) returned 1 [0130.342] CloseHandle (hObject=0x2e0) returned 1 [0130.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0130.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx", lpFilePart=0x0) returned 0x23 [0130.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0130.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx.rogue", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx.rogue", lpFilePart=0x0) returned 0x29 [0130.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0130.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-f m.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1515a5f0, ftCreationTime.dwHighDateTime=0x1d56ef9, ftLastAccessTime.dwLowDateTime=0xa2ddbe30, ftLastAccessTime.dwHighDateTime=0x1d5b37e, ftLastWriteTime.dwLowDateTime=0x566d0f9e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13eb0)) returned 1 [0130.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0130.345] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\-f m.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\-f m.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\-f m.xlsx.rogue")) returned 1 [0130.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0130.347] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", lpFilePart=0x0) returned 0x32 [0130.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0130.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7cdyn2pxdxlze0jxlwu.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0130.347] GetFileType (hFile=0x2e0) returned 0x1 [0130.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0130.347] GetFileType (hFile=0x2e0) returned 0x1 [0130.347] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1007f [0130.347] ReadFile (in: hFile=0x2e0, lpBuffer=0x28d4034, nNumberOfBytesToRead=0x1007f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28d4034*, lpNumberOfBytesRead=0x8fec60*=0x1007f, lpOverlapped=0x0) returned 1 [0130.349] CloseHandle (hObject=0x2e0) returned 1 [0130.533] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0130.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0130.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0130.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0130.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0130.534] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", lpFilePart=0x0) returned 0x32 [0130.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0130.534] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7cdyn2pxdxlze0jxlwu.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0130.536] GetFileType (hFile=0x2e0) returned 0x1 [0130.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0130.536] GetFileType (hFile=0x2e0) returned 0x1 [0130.536] WriteFile (in: hFile=0x2e0, lpBuffer=0x2950fb4*, nNumberOfBytesToWrite=0x10080, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2950fb4*, lpNumberOfBytesWritten=0x8fec54*=0x10080, lpOverlapped=0x0) returned 1 [0130.539] CloseHandle (hObject=0x2e0) returned 1 [0130.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0130.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx", lpFilePart=0x0) returned 0x32 [0130.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0130.542] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx.rogue", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx.rogue", lpFilePart=0x0) returned 0x38 [0130.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0130.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7cdyn2pxdxlze0jxlwu.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c5c40, ftCreationTime.dwHighDateTime=0x1d59379, ftLastAccessTime.dwLowDateTime=0x5530c120, ftLastAccessTime.dwHighDateTime=0x1d5b3c7, ftLastWriteTime.dwLowDateTime=0x5689ab09, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10080)) returned 1 [0130.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0130.543] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\7cdyn2pxdxlze0jxlwu.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\7cDyn2PxDXLZE0jXlwu.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\7cdyn2pxdxlze0jxlwu.xlsx.rogue")) returned 1 [0130.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0130.793] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", lpFilePart=0x0) returned 0x26 [0130.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0130.793] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7g-bfox.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0130.794] GetFileType (hFile=0x2e0) returned 0x1 [0130.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0130.794] GetFileType (hFile=0x2e0) returned 0x1 [0130.794] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1237c [0130.794] ReadFile (in: hFile=0x2e0, lpBuffer=0x29612b8, nNumberOfBytesToRead=0x1237c, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29612b8*, lpNumberOfBytesRead=0x8fec60*=0x1237c, lpOverlapped=0x0) returned 1 [0130.796] CloseHandle (hObject=0x2e0) returned 1 [0131.097] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0131.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0131.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0131.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0131.098] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", lpFilePart=0x0) returned 0x26 [0131.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0131.099] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7g-bfox.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.101] GetFileType (hFile=0x2e0) returned 0x1 [0131.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0131.101] GetFileType (hFile=0x2e0) returned 0x1 [0131.101] WriteFile (in: hFile=0x2e0, lpBuffer=0x27f89fc*, nNumberOfBytesToWrite=0x12380, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x27f89fc*, lpNumberOfBytesWritten=0x8fec54*=0x12380, lpOverlapped=0x0) returned 1 [0131.104] CloseHandle (hObject=0x2e0) returned 1 [0131.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0131.197] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx", lpFilePart=0x0) returned 0x26 [0131.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0131.198] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx.rogue", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx.rogue", lpFilePart=0x0) returned 0x2c [0131.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0131.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7g-bfox.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433d0e80, ftCreationTime.dwHighDateTime=0x1d5ed27, ftLastAccessTime.dwLowDateTime=0xefcf2670, ftLastAccessTime.dwHighDateTime=0x1d5a51e, ftLastWriteTime.dwLowDateTime=0x56edcdfd, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x12380)) returned 1 [0131.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0131.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\7g-bfox.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\7g-BfoX.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\7g-bfox.pptx.rogue")) returned 1 [0131.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0131.200] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", lpFilePart=0x0) returned 0x24 [0131.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0131.200] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bb4-2.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.201] GetFileType (hFile=0x2e0) returned 0x1 [0131.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0131.201] GetFileType (hFile=0x2e0) returned 0x1 [0131.201] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x4e8f [0131.201] ReadFile (in: hFile=0x2e0, lpBuffer=0x280afcc, nNumberOfBytesToRead=0x4e8f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x280afcc*, lpNumberOfBytesRead=0x8fec60*=0x4e8f, lpOverlapped=0x0) returned 1 [0131.202] CloseHandle (hObject=0x2e0) returned 1 [0131.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0131.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0131.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0131.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0131.446] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", lpFilePart=0x0) returned 0x24 [0131.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0131.446] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bb4-2.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.448] GetFileType (hFile=0x2e0) returned 0x1 [0131.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0131.448] GetFileType (hFile=0x2e0) returned 0x1 [0131.448] WriteFile (in: hFile=0x2e0, lpBuffer=0x28707e4*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28707e4*, lpNumberOfBytesWritten=0x8fec54*=0x4e90, lpOverlapped=0x0) returned 1 [0131.451] CloseHandle (hObject=0x2e0) returned 1 [0131.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0131.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx", lpFilePart=0x0) returned 0x24 [0131.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.453] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx.rogue", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx.rogue", lpFilePart=0x0) returned 0x2a [0131.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0131.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bb4-2.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29456200, ftCreationTime.dwHighDateTime=0x1d5e8e7, ftLastAccessTime.dwLowDateTime=0xb5a6b040, ftLastAccessTime.dwHighDateTime=0x1d599dd, ftLastWriteTime.dwLowDateTime=0x571656fc, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x4e90)) returned 1 [0131.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0131.453] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bb4-2.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\bb4-2.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bb4-2.pptx.rogue")) returned 1 [0131.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0131.454] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", lpFilePart=0x0) returned 0x31 [0131.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0131.454] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bfqz6tqusw0w2peamt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.454] GetFileType (hFile=0x2e0) returned 0x1 [0131.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0131.455] GetFileType (hFile=0x2e0) returned 0x1 [0131.455] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x3e54 [0131.455] ReadFile (in: hFile=0x2e0, lpBuffer=0x28758d4, nNumberOfBytesToRead=0x3e54, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28758d4*, lpNumberOfBytesRead=0x8fec60*=0x3e54, lpOverlapped=0x0) returned 1 [0131.456] CloseHandle (hObject=0x2e0) returned 1 [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0131.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0131.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0131.573] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", lpFilePart=0x0) returned 0x31 [0131.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0131.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bfqz6tqusw0w2peamt.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.628] GetFileType (hFile=0x2e0) returned 0x1 [0131.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0131.628] GetFileType (hFile=0x2e0) returned 0x1 [0131.628] WriteFile (in: hFile=0x2e0, lpBuffer=0x28d5e9c*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28d5e9c*, lpNumberOfBytesWritten=0x8fec54*=0x3e60, lpOverlapped=0x0) returned 1 [0131.630] CloseHandle (hObject=0x2e0) returned 1 [0131.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0131.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx", lpFilePart=0x0) returned 0x31 [0131.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0131.633] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx.rogue", lpFilePart=0x0) returned 0x37 [0131.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0131.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bfqz6tqusw0w2peamt.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8567920, ftCreationTime.dwHighDateTime=0x1d5707f, ftLastAccessTime.dwLowDateTime=0xd353e0a0, ftLastAccessTime.dwHighDateTime=0x1d5efe0, ftLastWriteTime.dwLowDateTime=0x5730d580, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3e60)) returned 1 [0131.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0131.633] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx" (normalized: "c:\\users\\fd1hvy\\documents\\bfqz6tqusw0w2peamt.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BfqZ6TqUSw0w2pEAmt.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bfqz6tqusw0w2peamt.docx.rogue")) returned 1 [0131.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0131.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", lpFilePart=0x0) returned 0x2b [0131.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0131.634] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d2x9nogunay1.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.634] GetFileType (hFile=0x2e0) returned 0x1 [0131.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0131.634] GetFileType (hFile=0x2e0) returned 0x1 [0131.634] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x16ecb [0131.636] ReadFile (in: hFile=0x2e0, lpBuffer=0x37994c8, nNumberOfBytesToRead=0x16ecb, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x37994c8*, lpNumberOfBytesRead=0x8fec60*=0x16ecb, lpOverlapped=0x0) returned 1 [0131.638] CloseHandle (hObject=0x2e0) returned 1 [0131.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0131.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0131.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0131.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0131.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0131.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", lpFilePart=0x0) returned 0x2b [0131.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0131.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d2x9nogunay1.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.883] GetFileType (hFile=0x2e0) returned 0x1 [0131.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0131.883] GetFileType (hFile=0x2e0) returned 0x1 [0131.883] WriteFile (in: hFile=0x2e0, lpBuffer=0x38a7368*, nNumberOfBytesToWrite=0x16ed0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x38a7368*, lpNumberOfBytesWritten=0x8fec54*=0x16ed0, lpOverlapped=0x0) returned 1 [0131.885] CloseHandle (hObject=0x2e0) returned 1 [0131.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0131.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx", lpFilePart=0x0) returned 0x2b [0131.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0131.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx.rogue", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx.rogue", lpFilePart=0x0) returned 0x31 [0131.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0131.889] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d2x9nogunay1.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc47300, ftCreationTime.dwHighDateTime=0x1d56a1b, ftLastAccessTime.dwLowDateTime=0x9a0961f0, ftLastAccessTime.dwHighDateTime=0x1d5706d, ftLastWriteTime.dwLowDateTime=0x57591955, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16ed0)) returned 1 [0131.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0131.890] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\d2x9nogunay1.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\D2x9noGuNaY1.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\d2x9nogunay1.xlsx.rogue")) returned 1 [0131.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0131.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", lpFilePart=0x0) returned 0x25 [0131.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0131.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ezzs02.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0131.891] GetFileType (hFile=0x2e0) returned 0x1 [0131.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0131.891] GetFileType (hFile=0x2e0) returned 0x1 [0131.891] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x17e4a [0131.891] ReadFile (in: hFile=0x2e0, lpBuffer=0x38be258, nNumberOfBytesToRead=0x17e4a, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x38be258*, lpNumberOfBytesRead=0x8fec60*=0x17e4a, lpOverlapped=0x0) returned 1 [0131.894] CloseHandle (hObject=0x2e0) returned 1 [0132.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0132.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0132.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0132.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0132.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0132.351] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", lpFilePart=0x0) returned 0x25 [0132.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0132.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ezzs02.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.355] GetFileType (hFile=0x2e0) returned 0x1 [0132.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0132.356] GetFileType (hFile=0x2e0) returned 0x1 [0132.356] WriteFile (in: hFile=0x2e0, lpBuffer=0x3935a20*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x3935a20*, lpNumberOfBytesWritten=0x8fec54*=0x17e50, lpOverlapped=0x0) returned 1 [0132.360] CloseHandle (hObject=0x2e0) returned 1 [0132.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0132.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx", lpFilePart=0x0) returned 0x25 [0132.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0132.364] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx.rogue", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx.rogue", lpFilePart=0x0) returned 0x2b [0132.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0132.365] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ezzs02.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15140bf0, ftCreationTime.dwHighDateTime=0x1d5d399, ftLastAccessTime.dwLowDateTime=0xad2321d0, ftLastAccessTime.dwHighDateTime=0x1d5a70a, ftLastWriteTime.dwLowDateTime=0x57a0a132, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x17e50)) returned 1 [0132.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0132.365] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ezzs02.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\eZZs02.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\ezzs02.pptx.rogue")) returned 1 [0132.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.367] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", lpFilePart=0x0) returned 0x2a [0132.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0132.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\h3g 5cnasdx.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.368] GetFileType (hFile=0x2e0) returned 0x1 [0132.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0132.368] GetFileType (hFile=0x2e0) returned 0x1 [0132.368] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xc5f6 [0132.368] ReadFile (in: hFile=0x2e0, lpBuffer=0x2974050, nNumberOfBytesToRead=0xc5f6, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2974050*, lpNumberOfBytesRead=0x8fec60*=0xc5f6, lpOverlapped=0x0) returned 1 [0132.369] CloseHandle (hObject=0x2e0) returned 1 [0132.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.548] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0132.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0132.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0132.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0132.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", lpFilePart=0x0) returned 0x2a [0132.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0132.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\h3g 5cnasdx.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.551] GetFileType (hFile=0x2e0) returned 0x1 [0132.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0132.551] GetFileType (hFile=0x2e0) returned 0x1 [0132.551] WriteFile (in: hFile=0x2e0, lpBuffer=0x27f5600*, nNumberOfBytesToWrite=0xc600, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x27f5600*, lpNumberOfBytesWritten=0x8fec54*=0xc600, lpOverlapped=0x0) returned 1 [0132.553] CloseHandle (hObject=0x2e0) returned 1 [0132.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx", lpFilePart=0x0) returned 0x2a [0132.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0132.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx.rogue", lpFilePart=0x0) returned 0x30 [0132.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0132.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\h3g 5cnasdx.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ade4a0, ftCreationTime.dwHighDateTime=0x1d5f005, ftLastAccessTime.dwLowDateTime=0x8e89b570, ftLastAccessTime.dwHighDateTime=0x1d5e951, ftLastWriteTime.dwLowDateTime=0x57bd8a2b, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xc600)) returned 1 [0132.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0132.557] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\h3g 5cnasdx.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\H3g 5cNASDx.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\h3g 5cnasdx.pptx.rogue")) returned 1 [0132.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0132.558] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", lpFilePart=0x0) returned 0x24 [0132.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0132.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h6vca.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.558] GetFileType (hFile=0x2e0) returned 0x1 [0132.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0132.558] GetFileType (hFile=0x2e0) returned 0x1 [0132.558] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x103a5 [0132.558] ReadFile (in: hFile=0x2e0, lpBuffer=0x2801e60, nNumberOfBytesToRead=0x103a5, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2801e60*, lpNumberOfBytesRead=0x8fec60*=0x103a5, lpOverlapped=0x0) returned 1 [0132.613] CloseHandle (hObject=0x2e0) returned 1 [0132.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.770] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0132.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0132.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0132.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0132.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0132.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", lpFilePart=0x0) returned 0x24 [0132.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0132.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h6vca.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.773] GetFileType (hFile=0x2e0) returned 0x1 [0132.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0132.773] GetFileType (hFile=0x2e0) returned 0x1 [0132.773] WriteFile (in: hFile=0x2e0, lpBuffer=0x287f8cc*, nNumberOfBytesToWrite=0x103b0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x287f8cc*, lpNumberOfBytesWritten=0x8fec54*=0x103b0, lpOverlapped=0x0) returned 1 [0132.776] CloseHandle (hObject=0x2e0) returned 1 [0132.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0132.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx", lpFilePart=0x0) returned 0x24 [0132.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0132.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx.rogue", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx.rogue", lpFilePart=0x0) returned 0x2a [0132.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0132.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h6vca.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ade56d0, ftCreationTime.dwHighDateTime=0x1d5a3b4, ftLastAccessTime.dwLowDateTime=0xcb0d9f10, ftLastAccessTime.dwHighDateTime=0x1d5b4dc, ftLastWriteTime.dwLowDateTime=0x57e82598, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x103b0)) returned 1 [0132.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0132.835] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx" (normalized: "c:\\users\\fd1hvy\\documents\\h6vca.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\H6VCA.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\h6vca.docx.rogue")) returned 1 [0132.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0132.836] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", lpFilePart=0x0) returned 0x25 [0132.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0132.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ldmybv.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0132.837] GetFileType (hFile=0x2e0) returned 0x1 [0132.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0132.837] GetFileType (hFile=0x2e0) returned 0x1 [0132.837] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xc4db [0132.837] ReadFile (in: hFile=0x2e0, lpBuffer=0x288fedc, nNumberOfBytesToRead=0xc4db, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x288fedc*, lpNumberOfBytesRead=0x8fec60*=0xc4db, lpOverlapped=0x0) returned 1 [0132.839] CloseHandle (hObject=0x2e0) returned 1 [0133.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.180] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0133.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0133.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0133.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0133.181] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", lpFilePart=0x0) returned 0x25 [0133.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0133.181] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ldmybv.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.182] GetFileType (hFile=0x2e0) returned 0x1 [0133.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0133.182] GetFileType (hFile=0x2e0) returned 0x1 [0133.182] WriteFile (in: hFile=0x2e0, lpBuffer=0x2901b7c*, nNumberOfBytesToWrite=0xc4e0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2901b7c*, lpNumberOfBytesWritten=0x8fec54*=0xc4e0, lpOverlapped=0x0) returned 1 [0133.184] CloseHandle (hObject=0x2e0) returned 1 [0133.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0133.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx", lpFilePart=0x0) returned 0x25 [0133.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0133.187] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx.rogue", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx.rogue", lpFilePart=0x0) returned 0x2b [0133.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0133.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ldmybv.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2b5540, ftCreationTime.dwHighDateTime=0x1d5c872, ftLastAccessTime.dwLowDateTime=0x76b41c10, ftLastAccessTime.dwHighDateTime=0x1d59bc7, ftLastWriteTime.dwLowDateTime=0x581efc02, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xc4e0)) returned 1 [0133.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0133.187] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ldmybv.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\LDmyBv.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\ldmybv.xlsx.rogue")) returned 1 [0133.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.188] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", lpFilePart=0x0) returned 0x2a [0133.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0133.188] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lysdfy7udy7.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.188] GetFileType (hFile=0x2e0) returned 0x1 [0133.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0133.188] GetFileType (hFile=0x2e0) returned 0x1 [0133.188] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xf68a [0133.188] ReadFile (in: hFile=0x2e0, lpBuffer=0x290e2b0, nNumberOfBytesToRead=0xf68a, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x290e2b0*, lpNumberOfBytesRead=0x8fec60*=0xf68a, lpOverlapped=0x0) returned 1 [0133.190] CloseHandle (hObject=0x2e0) returned 1 [0133.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0133.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0133.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0133.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", lpFilePart=0x0) returned 0x2a [0133.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0133.419] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lysdfy7udy7.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.421] GetFileType (hFile=0x2e0) returned 0x1 [0133.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0133.421] GetFileType (hFile=0x2e0) returned 0x1 [0133.421] WriteFile (in: hFile=0x2e0, lpBuffer=0x2989460*, nNumberOfBytesToWrite=0xf690, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2989460*, lpNumberOfBytesWritten=0x8fec54*=0xf690, lpOverlapped=0x0) returned 1 [0133.424] CloseHandle (hObject=0x2e0) returned 1 [0133.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx", lpFilePart=0x0) returned 0x2a [0133.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0133.427] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx.rogue", lpFilePart=0x0) returned 0x30 [0133.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0133.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lysdfy7udy7.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a7bcc0, ftCreationTime.dwHighDateTime=0x1d5e220, ftLastAccessTime.dwLowDateTime=0x996dd0a0, ftLastAccessTime.dwHighDateTime=0x1d5719e, ftLastWriteTime.dwLowDateTime=0x5842bf68, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xf690)) returned 1 [0133.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0133.428] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx" (normalized: "c:\\users\\fd1hvy\\documents\\lysdfy7udy7.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\lYSDfY7uDY7.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\lysdfy7udy7.docx.rogue")) returned 1 [0133.428] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0133.429] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", lpFilePart=0x0) returned 0x32 [0133.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0133.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\nwnpjkqf-qvoiznjvqs.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.429] GetFileType (hFile=0x2e0) returned 0x1 [0133.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0133.429] GetFileType (hFile=0x2e0) returned 0x1 [0133.429] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x182ca [0133.430] ReadFile (in: hFile=0x2e0, lpBuffer=0x39be2d0, nNumberOfBytesToRead=0x182ca, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x39be2d0*, lpNumberOfBytesRead=0x8fec60*=0x182ca, lpOverlapped=0x0) returned 1 [0133.432] CloseHandle (hObject=0x2e0) returned 1 [0133.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0133.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0133.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0133.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0133.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", lpFilePart=0x0) returned 0x32 [0133.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0133.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\nwnpjkqf-qvoiznjvqs.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.542] GetFileType (hFile=0x2e0) returned 0x1 [0133.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0133.543] GetFileType (hFile=0x2e0) returned 0x1 [0133.543] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a37118*, nNumberOfBytesToWrite=0x182d0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x3a37118*, lpNumberOfBytesWritten=0x8fec54*=0x182d0, lpOverlapped=0x0) returned 1 [0133.604] CloseHandle (hObject=0x2e0) returned 1 [0133.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0133.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx", lpFilePart=0x0) returned 0x32 [0133.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0133.607] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx.rogue", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx.rogue", lpFilePart=0x0) returned 0x38 [0133.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0133.607] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\nwnpjkqf-qvoiznjvqs.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc3c7a0, ftCreationTime.dwHighDateTime=0x1d5eec0, ftLastAccessTime.dwLowDateTime=0xc52134a0, ftLastAccessTime.dwHighDateTime=0x1d5d862, ftLastWriteTime.dwLowDateTime=0x585f7cdd, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x182d0)) returned 1 [0133.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0133.607] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx" (normalized: "c:\\users\\fd1hvy\\documents\\nwnpjkqf-qvoiznjvqs.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\nWNPjKQf-qVoIznJvQS.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\nwnpjkqf-qvoiznjvqs.docx.rogue")) returned 1 [0133.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0133.609] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", lpFilePart=0x0) returned 0x25 [0133.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0133.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\p664f5.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.609] GetFileType (hFile=0x2e0) returned 0x1 [0133.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0133.609] GetFileType (hFile=0x2e0) returned 0x1 [0133.609] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x50ec [0133.609] ReadFile (in: hFile=0x2e0, lpBuffer=0x29e5de0, nNumberOfBytesToRead=0x50ec, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29e5de0*, lpNumberOfBytesRead=0x8fec60*=0x50ec, lpOverlapped=0x0) returned 1 [0133.610] CloseHandle (hObject=0x2e0) returned 1 [0133.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0133.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0133.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0133.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0133.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", lpFilePart=0x0) returned 0x25 [0133.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0133.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\p664f5.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.808] GetFileType (hFile=0x2e0) returned 0x1 [0133.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0133.808] GetFileType (hFile=0x2e0) returned 0x1 [0133.808] WriteFile (in: hFile=0x2e0, lpBuffer=0x284dd30*, nNumberOfBytesToWrite=0x50f0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x284dd30*, lpNumberOfBytesWritten=0x8fec54*=0x50f0, lpOverlapped=0x0) returned 1 [0133.809] CloseHandle (hObject=0x2e0) returned 1 [0133.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0133.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx", lpFilePart=0x0) returned 0x25 [0133.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0133.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx.rogue", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx.rogue", lpFilePart=0x0) returned 0x2b [0133.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0133.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\p664f5.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56cb3b0, ftCreationTime.dwHighDateTime=0x1d5edd3, ftLastAccessTime.dwLowDateTime=0x76907f90, ftLastAccessTime.dwHighDateTime=0x1d5b1a1, ftLastWriteTime.dwLowDateTime=0x587e59f8, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x50f0)) returned 1 [0133.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0133.811] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\p664f5.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\p664f5.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\p664f5.pptx.rogue")) returned 1 [0133.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0133.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", lpFilePart=0x0) returned 0x27 [0133.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0133.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qkfb aruh.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.812] GetFileType (hFile=0x2e0) returned 0x1 [0133.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0133.812] GetFileType (hFile=0x2e0) returned 0x1 [0133.812] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x9773 [0133.812] ReadFile (in: hFile=0x2e0, lpBuffer=0x285306c, nNumberOfBytesToRead=0x9773, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x285306c*, lpNumberOfBytesRead=0x8fec60*=0x9773, lpOverlapped=0x0) returned 1 [0133.813] CloseHandle (hObject=0x2e0) returned 1 [0133.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.921] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0133.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0133.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0133.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0133.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", lpFilePart=0x0) returned 0x27 [0133.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0133.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qkfb aruh.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.925] GetFileType (hFile=0x2e0) returned 0x1 [0133.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0133.925] GetFileType (hFile=0x2e0) returned 0x1 [0133.925] WriteFile (in: hFile=0x2e0, lpBuffer=0x28cf534*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28cf534*, lpNumberOfBytesWritten=0x8fec54*=0x9780, lpOverlapped=0x0) returned 1 [0133.927] CloseHandle (hObject=0x2e0) returned 1 [0133.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0133.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv", lpFilePart=0x0) returned 0x27 [0133.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0133.929] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv.rogue", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv.rogue", lpFilePart=0x0) returned 0x2d [0133.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0133.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qkfb aruh.csv"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a23df70, ftCreationTime.dwHighDateTime=0x1d5eed2, ftLastAccessTime.dwLowDateTime=0x5a16b7b0, ftLastAccessTime.dwHighDateTime=0x1d5e2f9, ftLastWriteTime.dwLowDateTime=0x588f09d7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9780)) returned 1 [0133.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0133.929] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv" (normalized: "c:\\users\\fd1hvy\\documents\\qkfb aruh.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\qKfB ARuH.csv.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\qkfb aruh.csv.rogue")) returned 1 [0133.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0133.930] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", lpFilePart=0x0) returned 0x2a [0133.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0133.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls" (normalized: "c:\\users\\fd1hvy\\documents\\saur7n6xuh7j.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0133.931] GetFileType (hFile=0x2e0) returned 0x1 [0133.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0133.931] GetFileType (hFile=0x2e0) returned 0x1 [0133.931] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xc21a [0133.931] ReadFile (in: hFile=0x2e0, lpBuffer=0x28d8f10, nNumberOfBytesToRead=0xc21a, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28d8f10*, lpNumberOfBytesRead=0x8fec60*=0xc21a, lpOverlapped=0x0) returned 1 [0133.931] CloseHandle (hObject=0x2e0) returned 1 [0134.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0134.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0134.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0134.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0134.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0134.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0134.384] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", lpFilePart=0x0) returned 0x2a [0134.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0134.384] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls" (normalized: "c:\\users\\fd1hvy\\documents\\saur7n6xuh7j.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.386] GetFileType (hFile=0x2e0) returned 0x1 [0134.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0134.386] GetFileType (hFile=0x2e0) returned 0x1 [0134.386] WriteFile (in: hFile=0x2e0, lpBuffer=0x294a370*, nNumberOfBytesToWrite=0xc220, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x294a370*, lpNumberOfBytesWritten=0x8fec54*=0xc220, lpOverlapped=0x0) returned 1 [0134.389] CloseHandle (hObject=0x2e0) returned 1 [0134.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0134.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls", lpFilePart=0x0) returned 0x2a [0134.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0134.392] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls.rogue", lpFilePart=0x0) returned 0x30 [0134.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0134.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls" (normalized: "c:\\users\\fd1hvy\\documents\\saur7n6xuh7j.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc9dfe0, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0xcfb23a30, ftLastAccessTime.dwHighDateTime=0x1d5ecfe, ftLastWriteTime.dwLowDateTime=0x58d69064, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xc220)) returned 1 [0134.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0134.393] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls" (normalized: "c:\\users\\fd1hvy\\documents\\saur7n6xuh7j.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\sAUR7N6xUH7J.xls.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\saur7n6xuh7j.xls.rogue")) returned 1 [0134.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0134.393] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", lpFilePart=0x0) returned 0x32 [0134.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0134.393] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tq ang0bkulkxegtknb.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.394] GetFileType (hFile=0x2e0) returned 0x1 [0134.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0134.394] GetFileType (hFile=0x2e0) returned 0x1 [0134.394] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xb8c7 [0134.394] ReadFile (in: hFile=0x2e0, lpBuffer=0x295680c, nNumberOfBytesToRead=0xb8c7, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x295680c*, lpNumberOfBytesRead=0x8fec60*=0xb8c7, lpOverlapped=0x0) returned 1 [0134.395] CloseHandle (hObject=0x2e0) returned 1 [0134.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0134.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0134.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0134.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0134.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0134.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0134.549] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", lpFilePart=0x0) returned 0x32 [0134.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0134.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tq ang0bkulkxegtknb.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.551] GetFileType (hFile=0x2e0) returned 0x1 [0134.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0134.551] GetFileType (hFile=0x2e0) returned 0x1 [0134.551] WriteFile (in: hFile=0x2e0, lpBuffer=0x29c607c*, nNumberOfBytesToWrite=0xb8d0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29c607c*, lpNumberOfBytesWritten=0x8fec54*=0xb8d0, lpOverlapped=0x0) returned 1 [0134.553] CloseHandle (hObject=0x2e0) returned 1 [0134.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0134.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx", lpFilePart=0x0) returned 0x32 [0134.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0134.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx.rogue", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx.rogue", lpFilePart=0x0) returned 0x38 [0134.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0134.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tq ang0bkulkxegtknb.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f1da00, ftCreationTime.dwHighDateTime=0x1d57891, ftLastAccessTime.dwLowDateTime=0xe8e0dad0, ftLastAccessTime.dwHighDateTime=0x1d5b729, ftLastWriteTime.dwLowDateTime=0x58ee684c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb8d0)) returned 1 [0134.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0134.555] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\tq ang0bkulkxegtknb.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Tq aNg0bkUlKXeGtKnb.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\tq ang0bkulkxegtknb.xlsx.rogue")) returned 1 [0134.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0134.556] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", lpFilePart=0x0) returned 0x28 [0134.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0134.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\viqeivsjy.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.556] GetFileType (hFile=0x2e0) returned 0x1 [0134.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0134.556] GetFileType (hFile=0x2e0) returned 0x1 [0134.556] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x88d3 [0134.557] ReadFile (in: hFile=0x2e0, lpBuffer=0x29d1bec, nNumberOfBytesToRead=0x88d3, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29d1bec*, lpNumberOfBytesRead=0x8fec60*=0x88d3, lpOverlapped=0x0) returned 1 [0134.558] CloseHandle (hObject=0x2e0) returned 1 [0134.797] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0134.797] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0134.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0134.797] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0134.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0134.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0134.798] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", lpFilePart=0x0) returned 0x28 [0134.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0134.798] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\viqeivsjy.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.801] GetFileType (hFile=0x2e0) returned 0x1 [0134.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0134.801] GetFileType (hFile=0x2e0) returned 0x1 [0134.801] WriteFile (in: hFile=0x2e0, lpBuffer=0x284ce08*, nNumberOfBytesToWrite=0x88e0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x284ce08*, lpNumberOfBytesWritten=0x8fec54*=0x88e0, lpOverlapped=0x0) returned 1 [0134.803] CloseHandle (hObject=0x2e0) returned 1 [0134.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0134.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx", lpFilePart=0x0) returned 0x28 [0134.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0134.805] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx.rogue", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx.rogue", lpFilePart=0x0) returned 0x2e [0134.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0134.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\viqeivsjy.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc3a5f0, ftCreationTime.dwHighDateTime=0x1d564e3, ftLastAccessTime.dwLowDateTime=0x6a679280, ftLastAccessTime.dwHighDateTime=0x1d5e23e, ftLastWriteTime.dwLowDateTime=0x59148d44, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x88e0)) returned 1 [0134.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0134.805] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx" (normalized: "c:\\users\\fd1hvy\\documents\\viqeivsjy.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\ViQeivsJY.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\viqeivsjy.docx.rogue")) returned 1 [0134.806] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0134.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", lpFilePart=0x0) returned 0x2c [0134.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0134.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vyaj0ygy4ioh3.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0134.807] GetFileType (hFile=0x2e0) returned 0x1 [0134.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0134.807] GetFileType (hFile=0x2e0) returned 0x1 [0134.807] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x10d0b [0134.807] ReadFile (in: hFile=0x2e0, lpBuffer=0x2855950, nNumberOfBytesToRead=0x10d0b, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2855950*, lpNumberOfBytesRead=0x8fec60*=0x10d0b, lpOverlapped=0x0) returned 1 [0134.809] CloseHandle (hObject=0x2e0) returned 1 [0135.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0135.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0135.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0135.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0135.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0135.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0135.022] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", lpFilePart=0x0) returned 0x2c [0135.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0135.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vyaj0ygy4ioh3.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.024] GetFileType (hFile=0x2e0) returned 0x1 [0135.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0135.024] GetFileType (hFile=0x2e0) returned 0x1 [0135.024] WriteFile (in: hFile=0x2e0, lpBuffer=0x28d4fdc*, nNumberOfBytesToWrite=0x10d10, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28d4fdc*, lpNumberOfBytesWritten=0x8fec54*=0x10d10, lpOverlapped=0x0) returned 1 [0135.027] CloseHandle (hObject=0x2e0) returned 1 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx", lpFilePart=0x0) returned 0x2c [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx.rogue", lpFilePart=0x0) returned 0x32 [0135.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0135.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vyaj0ygy4ioh3.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cb0d3b0, ftCreationTime.dwHighDateTime=0x1d58114, ftLastAccessTime.dwLowDateTime=0x3d016910, ftLastAccessTime.dwHighDateTime=0x1d591ad, ftLastWriteTime.dwLowDateTime=0x5938cb1c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x10d10)) returned 1 [0135.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0135.032] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vyaj0ygy4ioh3.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\VYAJ0YGY4ioh3.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\vyaj0ygy4ioh3.pptx.rogue")) returned 1 [0135.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0135.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0135.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", lpFilePart=0x0) returned 0x2c [0135.038] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fda8 [0135.039] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147bb810, ftCreationTime.dwHighDateTime=0x1d5eb49, ftLastAccessTime.dwLowDateTime=0x75773fa0, ftLastAccessTime.dwHighDateTime=0x1d5e710, ftLastWriteTime.dwLowDateTime=0x75773fa0, ftLastWriteTime.dwHighDateTime=0x1d5e710, nFileSizeHigh=0x0, nFileSizeLow=0x739e, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oxtVTqbz.xlsx", cAlternateFileName="-OXTVT~1.XLS")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2fcaee0, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x4b890c60, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x4b890c60, ftLastWriteTime.dwHighDateTime=0x1d5ef07, nFileSizeHigh=0x0, nFileSizeLow=0x13f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0yExSR1EcDaCa.pptx", cAlternateFileName="0YEXSR~1.PPT")) returned 1 [0135.039] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd891f180, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0x3e521b60, ftLastAccessTime.dwHighDateTime=0x1d5e343, ftLastWriteTime.dwLowDateTime=0x3e521b60, ftLastWriteTime.dwHighDateTime=0x1d5e343, nFileSizeHigh=0x0, nFileSizeLow=0xda2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="c76yPRrZFtupscJ.csv", cAlternateFileName="C76YPR~1.CSV")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EkpCXfmGLqSjksKt", cAlternateFileName="EKPCXF~1")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2455590, ftCreationTime.dwHighDateTime=0x1d5ee67, ftLastAccessTime.dwLowDateTime=0xfecea4a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xfecea4a0, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0xb2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="JamlOT.odp", cAlternateFileName="")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb8070, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xba2597c0, ftLastAccessTime.dwHighDateTime=0x1d5e583, ftLastWriteTime.dwLowDateTime=0xba2597c0, ftLastWriteTime.dwHighDateTime=0x1d5e583, nFileSizeHigh=0x0, nFileSizeLow=0xc4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M-wk2sBzOk0vBj.rtf", cAlternateFileName="M-WK2S~1.RTF")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3818a4c0, ftCreationTime.dwHighDateTime=0x1d5e25e, ftLastAccessTime.dwLowDateTime=0x3ec9fc50, ftLastAccessTime.dwHighDateTime=0x1d5e89a, ftLastWriteTime.dwLowDateTime=0x3ec9fc50, ftLastWriteTime.dwHighDateTime=0x1d5e89a, nFileSizeHigh=0x0, nFileSizeLow=0xfd34, dwReserved0=0x0, dwReserved1=0x0, cFileName="QlEqa.csv", cAlternateFileName="")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5076fae0, ftCreationTime.dwHighDateTime=0x1d5e712, ftLastAccessTime.dwLowDateTime=0xda8923d0, ftLastAccessTime.dwHighDateTime=0x1d5e8ab, ftLastWriteTime.dwLowDateTime=0xda8923d0, ftLastWriteTime.dwHighDateTime=0x1d5e8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2433, dwReserved0=0x0, dwReserved1=0x0, cFileName="vP RWx hvaXM_P3VMT.xls", cAlternateFileName="VPRWXH~1.XLS")) returned 1 [0135.040] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c96e20, ftCreationTime.dwHighDateTime=0x1d5e185, ftLastAccessTime.dwLowDateTime=0x8dc4f2e0, ftLastAccessTime.dwHighDateTime=0x1d5ef04, ftLastWriteTime.dwLowDateTime=0x8dc4f2e0, ftLastWriteTime.dwHighDateTime=0x1d5ef04, nFileSizeHigh=0x0, nFileSizeLow=0x11768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xix7__hc.pps", cAlternateFileName="")) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96bace20, ftCreationTime.dwHighDateTime=0x1d5e698, ftLastAccessTime.dwLowDateTime=0xd62b0740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0xd62b0740, ftLastWriteTime.dwHighDateTime=0x1d5ec84, nFileSizeHigh=0x0, nFileSizeLow=0x13098, dwReserved0=0x0, dwReserved1=0x0, cFileName="XV2PbUNaDqxC0z.rtf", cAlternateFileName="XV2PBU~1.RTF")) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa850d80, ftCreationTime.dwHighDateTime=0x1d5ef7b, ftLastAccessTime.dwLowDateTime=0xbfa54960, ftLastAccessTime.dwHighDateTime=0x1d5e3f9, ftLastWriteTime.dwLowDateTime=0xbfa54960, ftLastWriteTime.dwHighDateTime=0x1d5e3f9, nFileSizeHigh=0x0, nFileSizeLow=0x161fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTAV26hU.pptx", cAlternateFileName="YTAV26~1.PPT")) returned 1 [0135.041] FindNextFileW (in: hFindFile=0x7a5fda8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.041] FindClose (in: hFindFile=0x7a5fda8 | out: hFindFile=0x7a5fda8) returned 1 [0135.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0135.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0135.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0135.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0135.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG", lpFilePart=0x0) returned 0x2c [0135.042] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fe28 [0135.042] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb2988f0, ftCreationTime.dwHighDateTime=0x1d5e35b, ftLastAccessTime.dwLowDateTime=0xe679fa0, ftLastAccessTime.dwHighDateTime=0x1d5e736, ftLastWriteTime.dwLowDateTime=0xe679fa0, ftLastWriteTime.dwHighDateTime=0x1d5e736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147bb810, ftCreationTime.dwHighDateTime=0x1d5eb49, ftLastAccessTime.dwLowDateTime=0x75773fa0, ftLastAccessTime.dwHighDateTime=0x1d5e710, ftLastWriteTime.dwLowDateTime=0x75773fa0, ftLastWriteTime.dwHighDateTime=0x1d5e710, nFileSizeHigh=0x0, nFileSizeLow=0x739e, dwReserved0=0x0, dwReserved1=0x0, cFileName="-oxtVTqbz.xlsx", cAlternateFileName="-OXTVT~1.XLS")) returned 1 [0135.042] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2fcaee0, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x4b890c60, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x4b890c60, ftLastWriteTime.dwHighDateTime=0x1d5ef07, nFileSizeHigh=0x0, nFileSizeLow=0x13f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="0yExSR1EcDaCa.pptx", cAlternateFileName="0YEXSR~1.PPT")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd891f180, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0x3e521b60, ftLastAccessTime.dwHighDateTime=0x1d5e343, ftLastWriteTime.dwLowDateTime=0x3e521b60, ftLastWriteTime.dwHighDateTime=0x1d5e343, nFileSizeHigh=0x0, nFileSizeLow=0xda2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="c76yPRrZFtupscJ.csv", cAlternateFileName="C76YPR~1.CSV")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EkpCXfmGLqSjksKt", cAlternateFileName="EKPCXF~1")) returned 1 [0135.043] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2455590, ftCreationTime.dwHighDateTime=0x1d5ee67, ftLastAccessTime.dwLowDateTime=0xfecea4a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c5, ftLastWriteTime.dwLowDateTime=0xfecea4a0, ftLastWriteTime.dwHighDateTime=0x1d5e1c5, nFileSizeHigh=0x0, nFileSizeLow=0xb2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="JamlOT.odp", cAlternateFileName="")) returned 1 [0135.506] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb8070, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xba2597c0, ftLastAccessTime.dwHighDateTime=0x1d5e583, ftLastWriteTime.dwLowDateTime=0xba2597c0, ftLastWriteTime.dwHighDateTime=0x1d5e583, nFileSizeHigh=0x0, nFileSizeLow=0xc4e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M-wk2sBzOk0vBj.rtf", cAlternateFileName="M-WK2S~1.RTF")) returned 1 [0135.507] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3818a4c0, ftCreationTime.dwHighDateTime=0x1d5e25e, ftLastAccessTime.dwLowDateTime=0x3ec9fc50, ftLastAccessTime.dwHighDateTime=0x1d5e89a, ftLastWriteTime.dwLowDateTime=0x3ec9fc50, ftLastWriteTime.dwHighDateTime=0x1d5e89a, nFileSizeHigh=0x0, nFileSizeLow=0xfd34, dwReserved0=0x0, dwReserved1=0x0, cFileName="QlEqa.csv", cAlternateFileName="")) returned 1 [0135.509] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5076fae0, ftCreationTime.dwHighDateTime=0x1d5e712, ftLastAccessTime.dwLowDateTime=0xda8923d0, ftLastAccessTime.dwHighDateTime=0x1d5e8ab, ftLastWriteTime.dwLowDateTime=0xda8923d0, ftLastWriteTime.dwHighDateTime=0x1d5e8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2433, dwReserved0=0x0, dwReserved1=0x0, cFileName="vP RWx hvaXM_P3VMT.xls", cAlternateFileName="VPRWXH~1.XLS")) returned 1 [0135.510] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c96e20, ftCreationTime.dwHighDateTime=0x1d5e185, ftLastAccessTime.dwLowDateTime=0x8dc4f2e0, ftLastAccessTime.dwHighDateTime=0x1d5ef04, ftLastWriteTime.dwLowDateTime=0x8dc4f2e0, ftLastWriteTime.dwHighDateTime=0x1d5ef04, nFileSizeHigh=0x0, nFileSizeLow=0x11768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xix7__hc.pps", cAlternateFileName="")) returned 1 [0135.510] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96bace20, ftCreationTime.dwHighDateTime=0x1d5e698, ftLastAccessTime.dwLowDateTime=0xd62b0740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0xd62b0740, ftLastWriteTime.dwHighDateTime=0x1d5ec84, nFileSizeHigh=0x0, nFileSizeLow=0x13098, dwReserved0=0x0, dwReserved1=0x0, cFileName="XV2PbUNaDqxC0z.rtf", cAlternateFileName="XV2PBU~1.RTF")) returned 1 [0135.510] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa850d80, ftCreationTime.dwHighDateTime=0x1d5ef7b, ftLastAccessTime.dwLowDateTime=0xbfa54960, ftLastAccessTime.dwHighDateTime=0x1d5e3f9, ftLastWriteTime.dwLowDateTime=0xbfa54960, ftLastWriteTime.dwHighDateTime=0x1d5e3f9, nFileSizeHigh=0x0, nFileSizeLow=0x161fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTAV26hU.pptx", cAlternateFileName="YTAV26~1.PPT")) returned 1 [0135.510] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa850d80, ftCreationTime.dwHighDateTime=0x1d5ef7b, ftLastAccessTime.dwLowDateTime=0xbfa54960, ftLastAccessTime.dwHighDateTime=0x1d5e3f9, ftLastWriteTime.dwLowDateTime=0xbfa54960, ftLastWriteTime.dwHighDateTime=0x1d5e3f9, nFileSizeHigh=0x0, nFileSizeLow=0x161fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="YTAV26hU.pptx", cAlternateFileName="YTAV26~1.PPT")) returned 0 [0135.511] FindClose (in: hFindFile=0x7a5fe28 | out: hFindFile=0x7a5fe28) returned 1 [0135.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0135.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0135.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0135.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", lpFilePart=0x0) returned 0x3b [0135.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0135.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\-oxtvtqbz.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.514] GetFileType (hFile=0x2e0) returned 0x1 [0135.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0135.514] GetFileType (hFile=0x2e0) returned 0x1 [0135.514] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x739e [0135.515] ReadFile (in: hFile=0x2e0, lpBuffer=0x28e8e70, nNumberOfBytesToRead=0x739e, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28e8e70*, lpNumberOfBytesRead=0x8febe8*=0x739e, lpOverlapped=0x0) returned 1 [0135.516] CloseHandle (hObject=0x2e0) returned 1 [0135.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0135.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0135.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0135.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0135.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0135.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0135.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", lpFilePart=0x0) returned 0x3b [0135.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0135.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\-oxtvtqbz.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.673] GetFileType (hFile=0x2e0) returned 0x1 [0135.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0135.673] GetFileType (hFile=0x2e0) returned 0x1 [0135.673] WriteFile (in: hFile=0x2e0, lpBuffer=0x2959e7c*, nNumberOfBytesToWrite=0x73a0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x2959e7c*, lpNumberOfBytesWritten=0x8febdc*=0x73a0, lpOverlapped=0x0) returned 1 [0135.739] CloseHandle (hObject=0x2e0) returned 1 [0135.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0135.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx", lpFilePart=0x0) returned 0x3b [0135.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0135.747] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx.rogue", nBufferLength=0x42, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx.rogue", lpFilePart=0x0) returned 0x41 [0135.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0135.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\-oxtvtqbz.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147bb810, ftCreationTime.dwHighDateTime=0x1d5eb49, ftLastAccessTime.dwLowDateTime=0x75773fa0, ftLastAccessTime.dwHighDateTime=0x1d5e710, ftLastWriteTime.dwLowDateTime=0x59a4689a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x73a0)) returned 1 [0135.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0135.747] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\-oxtvtqbz.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\-oxtVTqbz.xlsx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\-oxtvtqbz.xlsx.rogue")) returned 1 [0135.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0135.749] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", lpFilePart=0x0) returned 0x3f [0135.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0135.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\0yexsr1ecdaca.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.749] GetFileType (hFile=0x2e0) returned 0x1 [0135.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0135.749] GetFileType (hFile=0x2e0) returned 0x1 [0135.749] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x13f8f [0135.750] ReadFile (in: hFile=0x2e0, lpBuffer=0x29614a8, nNumberOfBytesToRead=0x13f8f, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x29614a8*, lpNumberOfBytesRead=0x8febe8*=0x13f8f, lpOverlapped=0x0) returned 1 [0135.750] CloseHandle (hObject=0x2e0) returned 1 [0135.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0135.780] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0135.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0135.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0135.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0135.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0135.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", lpFilePart=0x0) returned 0x3f [0135.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0135.781] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\0yexsr1ecdaca.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.783] GetFileType (hFile=0x2e0) returned 0x1 [0135.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0135.848] GetFileType (hFile=0x2e0) returned 0x1 [0135.848] WriteFile (in: hFile=0x2e0, lpBuffer=0x29ea158*, nNumberOfBytesToWrite=0x13f90, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x29ea158*, lpNumberOfBytesWritten=0x8febdc*=0x13f90, lpOverlapped=0x0) returned 1 [0135.850] CloseHandle (hObject=0x2e0) returned 1 [0135.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0135.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx", lpFilePart=0x0) returned 0x3f [0135.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0135.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx.rogue", nBufferLength=0x46, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx.rogue", lpFilePart=0x0) returned 0x45 [0135.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0135.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\0yexsr1ecdaca.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2fcaee0, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x4b890c60, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x59b519bc, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x13f90)) returned 1 [0135.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0135.853] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\0yexsr1ecdaca.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\0yExSR1EcDaCa.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\0yexsr1ecdaca.pptx.rogue")) returned 1 [0135.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0135.854] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", lpFilePart=0x0) returned 0x40 [0135.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0135.854] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\c76yprrzftupscj.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.854] GetFileType (hFile=0x2e0) returned 0x1 [0135.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0135.855] GetFileType (hFile=0x2e0) returned 0x1 [0135.855] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xda2c [0135.858] ReadFile (in: hFile=0x2e0, lpBuffer=0x27e9844, nNumberOfBytesToRead=0xda2c, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27e9844*, lpNumberOfBytesRead=0x8febe8*=0xda2c, lpOverlapped=0x0) returned 1 [0135.858] CloseHandle (hObject=0x2e0) returned 1 [0135.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0135.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0135.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0135.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0135.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0135.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0135.979] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", lpFilePart=0x0) returned 0x40 [0135.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0135.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\c76yprrzftupscj.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0135.981] GetFileType (hFile=0x2e0) returned 0x1 [0135.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0135.981] GetFileType (hFile=0x2e0) returned 0x1 [0135.981] WriteFile (in: hFile=0x2e0, lpBuffer=0x285f62c*, nNumberOfBytesToWrite=0xda30, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x285f62c*, lpNumberOfBytesWritten=0x8febdc*=0xda30, lpOverlapped=0x0) returned 1 [0135.984] CloseHandle (hObject=0x2e0) returned 1 [0136.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0136.033] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv", lpFilePart=0x0) returned 0x40 [0136.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0136.034] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv.rogue", nBufferLength=0x47, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv.rogue", lpFilePart=0x0) returned 0x46 [0136.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0136.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\c76yprrzftupscj.csv"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd891f180, ftCreationTime.dwHighDateTime=0x1d5e818, ftLastAccessTime.dwLowDateTime=0x3e521b60, ftLastAccessTime.dwHighDateTime=0x1d5e343, ftLastWriteTime.dwLowDateTime=0x59d1b6a1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xda30)) returned 1 [0136.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0136.034] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\c76yprrzftupscj.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\c76yPRrZFtupscJ.csv.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\c76yprrzftupscj.csv.rogue")) returned 1 [0136.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.035] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", lpFilePart=0x0) returned 0x3f [0136.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0136.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\m-wk2sbzok0vbj.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.035] GetFileType (hFile=0x2e0) returned 0x1 [0136.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0136.036] GetFileType (hFile=0x2e0) returned 0x1 [0136.036] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xc4e8 [0136.036] ReadFile (in: hFile=0x2e0, lpBuffer=0x286d314, nNumberOfBytesToRead=0xc4e8, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x286d314*, lpNumberOfBytesRead=0x8febe8*=0xc4e8, lpOverlapped=0x0) returned 1 [0136.037] CloseHandle (hObject=0x2e0) returned 1 [0136.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0136.296] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0136.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0136.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0136.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0136.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", lpFilePart=0x0) returned 0x3f [0136.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0136.297] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\m-wk2sbzok0vbj.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.443] GetFileType (hFile=0x2e0) returned 0x1 [0136.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0136.443] GetFileType (hFile=0x2e0) returned 0x1 [0136.443] WriteFile (in: hFile=0x2e0, lpBuffer=0x27d562c*, nNumberOfBytesToWrite=0xc4f0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x27d562c*, lpNumberOfBytesWritten=0x8febdc*=0xc4f0, lpOverlapped=0x0) returned 1 [0136.447] CloseHandle (hObject=0x2e0) returned 1 [0136.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf", lpFilePart=0x0) returned 0x3f [0136.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0136.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf.rogue", nBufferLength=0x46, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf.rogue", lpFilePart=0x0) returned 0x45 [0136.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0136.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\m-wk2sbzok0vbj.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43eb8070, ftCreationTime.dwHighDateTime=0x1d5e1c2, ftLastAccessTime.dwLowDateTime=0xba2597c0, ftLastAccessTime.dwHighDateTime=0x1d5e583, ftLastWriteTime.dwLowDateTime=0x5a114f4f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xc4f0)) returned 1 [0136.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0136.451] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\m-wk2sbzok0vbj.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\M-wk2sBzOk0vBj.rtf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\m-wk2sbzok0vbj.rtf.rogue")) returned 1 [0136.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0136.452] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", lpFilePart=0x0) returned 0x36 [0136.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0136.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\qleqa.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.452] GetFileType (hFile=0x2e0) returned 0x1 [0136.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0136.452] GetFileType (hFile=0x2e0) returned 0x1 [0136.453] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xfd34 [0136.453] ReadFile (in: hFile=0x2e0, lpBuffer=0x27e1da4, nNumberOfBytesToRead=0xfd34, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27e1da4*, lpNumberOfBytesRead=0x8febe8*=0xfd34, lpOverlapped=0x0) returned 1 [0136.454] CloseHandle (hObject=0x2e0) returned 1 [0136.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0136.717] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0136.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0136.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0136.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0136.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0136.719] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", lpFilePart=0x0) returned 0x36 [0136.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0136.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\qleqa.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.723] GetFileType (hFile=0x2e0) returned 0x1 [0136.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0136.723] GetFileType (hFile=0x2e0) returned 0x1 [0136.723] WriteFile (in: hFile=0x2e0, lpBuffer=0x285e4bc*, nNumberOfBytesToWrite=0xfd40, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x285e4bc*, lpNumberOfBytesWritten=0x8febdc*=0xfd40, lpOverlapped=0x0) returned 1 [0136.726] CloseHandle (hObject=0x2e0) returned 1 [0136.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0136.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv", lpFilePart=0x0) returned 0x36 [0136.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0136.733] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv.rogue", nBufferLength=0x3d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv.rogue", lpFilePart=0x0) returned 0x3c [0136.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0136.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\qleqa.csv"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3818a4c0, ftCreationTime.dwHighDateTime=0x1d5e25e, ftLastAccessTime.dwLowDateTime=0x3ec9fc50, ftLastAccessTime.dwHighDateTime=0x1d5e89a, ftLastWriteTime.dwLowDateTime=0x5a3af7f8, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xfd40)) returned 1 [0136.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0136.733] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\qleqa.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\QlEqa.csv.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\qleqa.csv.rogue")) returned 1 [0136.735] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0136.735] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", lpFilePart=0x0) returned 0x43 [0136.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0136.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\vp rwx hvaxm_p3vmt.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.736] GetFileType (hFile=0x2e0) returned 0x1 [0136.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0136.736] GetFileType (hFile=0x2e0) returned 0x1 [0136.736] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x2433 [0136.736] ReadFile (in: hFile=0x2e0, lpBuffer=0x286e47c, nNumberOfBytesToRead=0x2433, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x286e47c*, lpNumberOfBytesRead=0x8febe8*=0x2433, lpOverlapped=0x0) returned 1 [0136.736] CloseHandle (hObject=0x2e0) returned 1 [0136.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0136.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0136.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0136.809] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0136.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0136.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0136.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", lpFilePart=0x0) returned 0x43 [0136.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0136.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\vp rwx hvaxm_p3vmt.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.812] GetFileType (hFile=0x2e0) returned 0x1 [0136.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0136.812] GetFileType (hFile=0x2e0) returned 0x1 [0136.812] WriteFile (in: hFile=0x2e0, lpBuffer=0x28c67a8*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28c67a8*, lpNumberOfBytesWritten=0x8febdc*=0x2440, lpOverlapped=0x0) returned 1 [0136.813] CloseHandle (hObject=0x2e0) returned 1 [0136.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0136.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls", lpFilePart=0x0) returned 0x43 [0136.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0136.816] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls.rogue", nBufferLength=0x4a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls.rogue", lpFilePart=0x0) returned 0x49 [0136.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0136.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\vp rwx hvaxm_p3vmt.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5076fae0, ftCreationTime.dwHighDateTime=0x1d5e712, ftLastAccessTime.dwLowDateTime=0xda8923d0, ftLastAccessTime.dwHighDateTime=0x1d5e8ab, ftLastWriteTime.dwLowDateTime=0x5a46e2d4, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2440)) returned 1 [0136.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0136.818] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\vp rwx hvaxm_p3vmt.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\vP RWx hvaXM_P3VMT.xls.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\vp rwx hvaxm_p3vmt.xls.rogue")) returned 1 [0136.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.819] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", lpFilePart=0x0) returned 0x3f [0136.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0136.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\xv2pbunadqxc0z.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.819] GetFileType (hFile=0x2e0) returned 0x1 [0136.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0136.820] GetFileType (hFile=0x2e0) returned 0x1 [0136.820] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x13098 [0136.820] ReadFile (in: hFile=0x2e0, lpBuffer=0x28c8eac, nNumberOfBytesToRead=0x13098, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28c8eac*, lpNumberOfBytesRead=0x8febe8*=0x13098, lpOverlapped=0x0) returned 1 [0136.821] CloseHandle (hObject=0x2e0) returned 1 [0136.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0136.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0136.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0136.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0136.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0136.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", lpFilePart=0x0) returned 0x3f [0136.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0136.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\xv2pbunadqxc0z.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.912] GetFileType (hFile=0x2e0) returned 0x1 [0136.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0136.912] GetFileType (hFile=0x2e0) returned 0x1 [0136.912] WriteFile (in: hFile=0x2e0, lpBuffer=0x294ee88*, nNumberOfBytesToWrite=0x130a0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x294ee88*, lpNumberOfBytesWritten=0x8febdc*=0x130a0, lpOverlapped=0x0) returned 1 [0136.915] CloseHandle (hObject=0x2e0) returned 1 [0136.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0136.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf", lpFilePart=0x0) returned 0x3f [0136.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0136.925] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf.rogue", nBufferLength=0x46, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf.rogue", lpFilePart=0x0) returned 0x45 [0136.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0136.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\xv2pbunadqxc0z.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96bace20, ftCreationTime.dwHighDateTime=0x1d5e698, ftLastAccessTime.dwLowDateTime=0xd62b0740, ftLastAccessTime.dwHighDateTime=0x1d5ec84, ftLastWriteTime.dwLowDateTime=0x5a57951d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x130a0)) returned 1 [0136.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0136.925] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\xv2pbunadqxc0z.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\XV2PbUNaDqxC0z.rtf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\xv2pbunadqxc0z.rtf.rogue")) returned 1 [0136.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0136.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", lpFilePart=0x0) returned 0x3a [0136.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0136.975] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ytav26hu.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0136.975] GetFileType (hFile=0x2e0) returned 0x1 [0136.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0136.976] GetFileType (hFile=0x2e0) returned 0x1 [0136.976] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x161fe [0136.976] ReadFile (in: hFile=0x2e0, lpBuffer=0x3824e68, nNumberOfBytesToRead=0x161fe, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x3824e68*, lpNumberOfBytesRead=0x8febe8*=0x161fe, lpOverlapped=0x0) returned 1 [0136.978] CloseHandle (hObject=0x2e0) returned 1 [0137.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0137.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0137.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0137.011] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", lpFilePart=0x0) returned 0x3a [0137.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0137.011] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ytav26hu.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.013] GetFileType (hFile=0x2e0) returned 0x1 [0137.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0137.013] GetFileType (hFile=0x2e0) returned 0x1 [0137.013] WriteFile (in: hFile=0x2e0, lpBuffer=0x38938a8*, nNumberOfBytesToWrite=0x16200, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x38938a8*, lpNumberOfBytesWritten=0x8febdc*=0x16200, lpOverlapped=0x0) returned 1 [0137.016] CloseHandle (hObject=0x2e0) returned 1 [0137.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0137.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx", lpFilePart=0x0) returned 0x3a [0137.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0137.079] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx.rogue", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx.rogue", lpFilePart=0x0) returned 0x40 [0137.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0137.079] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ytav26hu.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa850d80, ftCreationTime.dwHighDateTime=0x1d5ef7b, ftLastAccessTime.dwLowDateTime=0xbfa54960, ftLastAccessTime.dwHighDateTime=0x1d5e3f9, ftLastWriteTime.dwLowDateTime=0x5a6f6b5e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16200)) returned 1 [0137.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0137.080] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ytav26hu.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\YTAV26hU.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ytav26hu.pptx.rogue")) returned 1 [0137.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0137.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0137.081] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", lpFilePart=0x0) returned 0x3d [0137.082] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fb68 [0137.083] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.083] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0YeBTtJHR0qkdxPU", cAlternateFileName="0YEBTT~1")) returned 1 [0137.083] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x981b3650, ftCreationTime.dwHighDateTime=0x1d5e257, ftLastAccessTime.dwLowDateTime=0x1fbca170, ftLastAccessTime.dwHighDateTime=0x1d5e140, ftLastWriteTime.dwLowDateTime=0x1fbca170, ftLastWriteTime.dwHighDateTime=0x1d5e140, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x0, dwReserved1=0x0, cFileName="GaXiDwXhz29w.ods", cAlternateFileName="GAXIDW~1.ODS")) returned 1 [0137.083] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b89520, ftCreationTime.dwHighDateTime=0x1d5eeb7, ftLastAccessTime.dwLowDateTime=0x36794bd0, ftLastAccessTime.dwHighDateTime=0x1d5e9e1, ftLastWriteTime.dwLowDateTime=0x36794bd0, ftLastWriteTime.dwHighDateTime=0x1d5e9e1, nFileSizeHigh=0x0, nFileSizeLow=0x11590, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMVFmYTE5.ods", cAlternateFileName="GMVFMY~1.ODS")) returned 1 [0137.083] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ffaf90, ftCreationTime.dwHighDateTime=0x1d5e438, ftLastAccessTime.dwLowDateTime=0x27834330, ftLastAccessTime.dwHighDateTime=0x1d5e453, ftLastWriteTime.dwLowDateTime=0x27834330, ftLastWriteTime.dwHighDateTime=0x1d5e453, nFileSizeHigh=0x0, nFileSizeLow=0xc512, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaT 54Qc.odp", cAlternateFileName="IAT54Q~1.ODP")) returned 1 [0137.084] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572a9d70, ftCreationTime.dwHighDateTime=0x1d5eef0, ftLastAccessTime.dwLowDateTime=0x960eb270, ftLastAccessTime.dwHighDateTime=0x1d5e170, ftLastWriteTime.dwLowDateTime=0x960eb270, ftLastWriteTime.dwHighDateTime=0x1d5e170, nFileSizeHigh=0x0, nFileSizeLow=0x47b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="kP_vwmyPJsAQ.odp", cAlternateFileName="KP_VWM~1.ODP")) returned 1 [0137.084] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21fbce0, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x7aac5ec0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x7aac5ec0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x44c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNYoKrg KA4E63e.doc", cAlternateFileName="UNYOKR~1.DOC")) returned 1 [0137.084] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0137.084] FindClose (in: hFindFile=0x7a5fb68 | out: hFindFile=0x7a5fb68) returned 1 [0137.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0137.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0137.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0137.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0137.085] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt", lpFilePart=0x0) returned 0x3d [0137.085] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa68 [0137.085] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dabc9e0, ftCreationTime.dwHighDateTime=0x1d5e86c, ftLastAccessTime.dwLowDateTime=0x1028e590, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x1028e590, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.085] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0YeBTtJHR0qkdxPU", cAlternateFileName="0YEBTT~1")) returned 1 [0137.086] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x981b3650, ftCreationTime.dwHighDateTime=0x1d5e257, ftLastAccessTime.dwLowDateTime=0x1fbca170, ftLastAccessTime.dwHighDateTime=0x1d5e140, ftLastWriteTime.dwLowDateTime=0x1fbca170, ftLastWriteTime.dwHighDateTime=0x1d5e140, nFileSizeHigh=0x0, nFileSizeLow=0x7288, dwReserved0=0x0, dwReserved1=0x0, cFileName="GaXiDwXhz29w.ods", cAlternateFileName="GAXIDW~1.ODS")) returned 1 [0137.086] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b89520, ftCreationTime.dwHighDateTime=0x1d5eeb7, ftLastAccessTime.dwLowDateTime=0x36794bd0, ftLastAccessTime.dwHighDateTime=0x1d5e9e1, ftLastWriteTime.dwLowDateTime=0x36794bd0, ftLastWriteTime.dwHighDateTime=0x1d5e9e1, nFileSizeHigh=0x0, nFileSizeLow=0x11590, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMVFmYTE5.ods", cAlternateFileName="GMVFMY~1.ODS")) returned 1 [0137.086] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ffaf90, ftCreationTime.dwHighDateTime=0x1d5e438, ftLastAccessTime.dwLowDateTime=0x27834330, ftLastAccessTime.dwHighDateTime=0x1d5e453, ftLastWriteTime.dwLowDateTime=0x27834330, ftLastWriteTime.dwHighDateTime=0x1d5e453, nFileSizeHigh=0x0, nFileSizeLow=0xc512, dwReserved0=0x0, dwReserved1=0x0, cFileName="iaT 54Qc.odp", cAlternateFileName="IAT54Q~1.ODP")) returned 1 [0137.086] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x572a9d70, ftCreationTime.dwHighDateTime=0x1d5eef0, ftLastAccessTime.dwLowDateTime=0x960eb270, ftLastAccessTime.dwHighDateTime=0x1d5e170, ftLastWriteTime.dwLowDateTime=0x960eb270, ftLastWriteTime.dwHighDateTime=0x1d5e170, nFileSizeHigh=0x0, nFileSizeLow=0x47b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="kP_vwmyPJsAQ.odp", cAlternateFileName="KP_VWM~1.ODP")) returned 1 [0137.087] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21fbce0, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x7aac5ec0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x7aac5ec0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x44c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNYoKrg KA4E63e.doc", cAlternateFileName="UNYOKR~1.DOC")) returned 1 [0137.087] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21fbce0, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x7aac5ec0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x7aac5ec0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x44c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UNYoKrg KA4E63e.doc", cAlternateFileName="UNYOKR~1.DOC")) returned 0 [0137.087] FindClose (in: hFindFile=0x7a5fa68 | out: hFindFile=0x7a5fa68) returned 1 [0137.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0137.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0137.087] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0137.088] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x52, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", lpFilePart=0x0) returned 0x51 [0137.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0137.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\unyokrg ka4e63e.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.088] GetFileType (hFile=0x2e0) returned 0x1 [0137.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0137.088] GetFileType (hFile=0x2e0) returned 0x1 [0137.088] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0x44c3 [0137.088] ReadFile (in: hFile=0x2e0, lpBuffer=0x29b17d4, nNumberOfBytesToRead=0x44c3, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x29b17d4*, lpNumberOfBytesRead=0x8feb70*=0x44c3, lpOverlapped=0x0) returned 1 [0137.089] CloseHandle (hObject=0x2e0) returned 1 [0137.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0137.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0137.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0137.467] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x52, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", lpFilePart=0x0) returned 0x51 [0137.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0137.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\unyokrg ka4e63e.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.469] GetFileType (hFile=0x2e0) returned 0x1 [0137.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0137.469] GetFileType (hFile=0x2e0) returned 0x1 [0137.469] WriteFile (in: hFile=0x2e0, lpBuffer=0x2818cd8*, nNumberOfBytesToWrite=0x44d0, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x2818cd8*, lpNumberOfBytesWritten=0x8feb64*=0x44d0, lpOverlapped=0x0) returned 1 [0137.471] CloseHandle (hObject=0x2e0) returned 1 [0137.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0137.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", nBufferLength=0x52, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc", lpFilePart=0x0) returned 0x51 [0137.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0137.473] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc.rogue", nBufferLength=0x58, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc.rogue", lpFilePart=0x0) returned 0x57 [0137.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0137.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\unyokrg ka4e63e.doc"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21fbce0, ftCreationTime.dwHighDateTime=0x1d5e880, ftLastAccessTime.dwLowDateTime=0x7aac5ec0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x5aab0a87, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x44d0)) returned 1 [0137.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0137.473] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\unyokrg ka4e63e.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\UNYoKrg KA4E63e.doc.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\unyokrg ka4e63e.doc.rogue")) returned 1 [0137.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0137.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0137.475] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", nBufferLength=0x4f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", lpFilePart=0x0) returned 0x4e [0137.475] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0137.475] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592221d0, ftCreationTime.dwHighDateTime=0x1d5f01b, ftLastAccessTime.dwLowDateTime=0x647c5a30, ftLastAccessTime.dwHighDateTime=0x1d5e5ff, ftLastWriteTime.dwLowDateTime=0x647c5a30, ftLastWriteTime.dwHighDateTime=0x1d5e5ff, nFileSizeHigh=0x0, nFileSizeLow=0x82ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Awv7f.pptx", cAlternateFileName="7AWV7F~1.PPT")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d1c30, ftCreationTime.dwHighDateTime=0x1d5e0b3, ftLastAccessTime.dwLowDateTime=0x93a52940, ftLastAccessTime.dwHighDateTime=0x1d5ebf4, ftLastWriteTime.dwLowDateTime=0x93a52940, ftLastWriteTime.dwHighDateTime=0x1d5ebf4, nFileSizeHigh=0x0, nFileSizeLow=0x29e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="903BtdaAG5pAio5iDmVg.ppt", cAlternateFileName="903BTD~1.PPT")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x345ecd0, ftCreationTime.dwHighDateTime=0x1d5e664, ftLastAccessTime.dwLowDateTime=0xb59b630, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0xb59b630, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x8dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="heN0HmkU.pdf", cAlternateFileName="")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5e19890, ftCreationTime.dwHighDateTime=0x1d5e59b, ftLastAccessTime.dwLowDateTime=0x7ff3af30, ftLastAccessTime.dwHighDateTime=0x1d5e9fa, ftLastWriteTime.dwLowDateTime=0x7ff3af30, ftLastWriteTime.dwHighDateTime=0x1d5e9fa, nFileSizeHigh=0x0, nFileSizeLow=0xd3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="kzu6_bjASyhrqys6.odp", cAlternateFileName="KZU6_B~1.ODP")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d06cc00, ftCreationTime.dwHighDateTime=0x1d5ea6f, ftLastAccessTime.dwLowDateTime=0xda412090, ftLastAccessTime.dwHighDateTime=0x1d5ea67, ftLastWriteTime.dwLowDateTime=0xda412090, ftLastWriteTime.dwHighDateTime=0x1d5ea67, nFileSizeHigh=0x0, nFileSizeLow=0x2a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_hrS1sa ZZ40mPhp.rtf", cAlternateFileName="K_HRS1~1.RTF")) returned 1 [0137.476] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21d569b0, ftCreationTime.dwHighDateTime=0x1d5f072, ftLastAccessTime.dwLowDateTime=0x3ebc1020, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x3ebc1020, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf11, dwReserved0=0x0, dwReserved1=0x0, cFileName="U7cniQib9x0mu0eu28Kb.ots", cAlternateFileName="U7CNIQ~1.OTS")) returned 1 [0137.477] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9042af80, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0xe72ad730, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0xe72ad730, ftLastWriteTime.dwHighDateTime=0x1d5ee70, nFileSizeHigh=0x0, nFileSizeLow=0x4d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVv WhcaT0D5a 2E.xls", cAlternateFileName="WVVWHC~1.XLS")) returned 1 [0137.477] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d40060, ftCreationTime.dwHighDateTime=0x1d5ee2c, ftLastAccessTime.dwLowDateTime=0x973b1040, ftLastAccessTime.dwHighDateTime=0x1d5e2eb, ftLastWriteTime.dwLowDateTime=0x973b1040, ftLastWriteTime.dwHighDateTime=0x1d5e2eb, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="xCP 8pPvRZi0fmmOG.pdf", cAlternateFileName="XCP8PP~1.PDF")) returned 1 [0137.477] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0137.477] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0137.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0137.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0137.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0137.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0137.478] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", nBufferLength=0x4f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU", lpFilePart=0x0) returned 0x4e [0137.478] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fc28 [0137.478] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417a9880, ftCreationTime.dwHighDateTime=0x1d5e4d8, ftLastAccessTime.dwLowDateTime=0xc280a380, ftLastAccessTime.dwHighDateTime=0x1d5e955, ftLastWriteTime.dwLowDateTime=0xc280a380, ftLastWriteTime.dwHighDateTime=0x1d5e955, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0137.478] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592221d0, ftCreationTime.dwHighDateTime=0x1d5f01b, ftLastAccessTime.dwLowDateTime=0x647c5a30, ftLastAccessTime.dwHighDateTime=0x1d5e5ff, ftLastWriteTime.dwLowDateTime=0x647c5a30, ftLastWriteTime.dwHighDateTime=0x1d5e5ff, nFileSizeHigh=0x0, nFileSizeLow=0x82ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Awv7f.pptx", cAlternateFileName="7AWV7F~1.PPT")) returned 1 [0137.478] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d1c30, ftCreationTime.dwHighDateTime=0x1d5e0b3, ftLastAccessTime.dwLowDateTime=0x93a52940, ftLastAccessTime.dwHighDateTime=0x1d5ebf4, ftLastWriteTime.dwLowDateTime=0x93a52940, ftLastWriteTime.dwHighDateTime=0x1d5ebf4, nFileSizeHigh=0x0, nFileSizeLow=0x29e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="903BtdaAG5pAio5iDmVg.ppt", cAlternateFileName="903BTD~1.PPT")) returned 1 [0137.479] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x345ecd0, ftCreationTime.dwHighDateTime=0x1d5e664, ftLastAccessTime.dwLowDateTime=0xb59b630, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0xb59b630, ftLastWriteTime.dwHighDateTime=0x1d5e52f, nFileSizeHigh=0x0, nFileSizeLow=0x8dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="heN0HmkU.pdf", cAlternateFileName="")) returned 1 [0137.479] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5e19890, ftCreationTime.dwHighDateTime=0x1d5e59b, ftLastAccessTime.dwLowDateTime=0x7ff3af30, ftLastAccessTime.dwHighDateTime=0x1d5e9fa, ftLastWriteTime.dwLowDateTime=0x7ff3af30, ftLastWriteTime.dwHighDateTime=0x1d5e9fa, nFileSizeHigh=0x0, nFileSizeLow=0xd3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="kzu6_bjASyhrqys6.odp", cAlternateFileName="KZU6_B~1.ODP")) returned 1 [0137.479] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d06cc00, ftCreationTime.dwHighDateTime=0x1d5ea6f, ftLastAccessTime.dwLowDateTime=0xda412090, ftLastAccessTime.dwHighDateTime=0x1d5ea67, ftLastWriteTime.dwLowDateTime=0xda412090, ftLastWriteTime.dwHighDateTime=0x1d5ea67, nFileSizeHigh=0x0, nFileSizeLow=0x2a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="K_hrS1sa ZZ40mPhp.rtf", cAlternateFileName="K_HRS1~1.RTF")) returned 1 [0137.479] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21d569b0, ftCreationTime.dwHighDateTime=0x1d5f072, ftLastAccessTime.dwLowDateTime=0x3ebc1020, ftLastAccessTime.dwHighDateTime=0x1d5e7ca, ftLastWriteTime.dwLowDateTime=0x3ebc1020, ftLastWriteTime.dwHighDateTime=0x1d5e7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcf11, dwReserved0=0x0, dwReserved1=0x0, cFileName="U7cniQib9x0mu0eu28Kb.ots", cAlternateFileName="U7CNIQ~1.OTS")) returned 1 [0137.480] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9042af80, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0xe72ad730, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0xe72ad730, ftLastWriteTime.dwHighDateTime=0x1d5ee70, nFileSizeHigh=0x0, nFileSizeLow=0x4d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="WVv WhcaT0D5a 2E.xls", cAlternateFileName="WVVWHC~1.XLS")) returned 1 [0137.480] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d40060, ftCreationTime.dwHighDateTime=0x1d5ee2c, ftLastAccessTime.dwLowDateTime=0x973b1040, ftLastAccessTime.dwHighDateTime=0x1d5e2eb, ftLastWriteTime.dwLowDateTime=0x973b1040, ftLastWriteTime.dwHighDateTime=0x1d5e2eb, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="xCP 8pPvRZi0fmmOG.pdf", cAlternateFileName="XCP8PP~1.PDF")) returned 1 [0137.480] FindNextFileW (in: hFindFile=0x7a5fc28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d40060, ftCreationTime.dwHighDateTime=0x1d5ee2c, ftLastAccessTime.dwLowDateTime=0x973b1040, ftLastAccessTime.dwHighDateTime=0x1d5e2eb, ftLastWriteTime.dwLowDateTime=0x973b1040, ftLastWriteTime.dwHighDateTime=0x1d5e2eb, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="xCP 8pPvRZi0fmmOG.pdf", cAlternateFileName="XCP8PP~1.PDF")) returned 0 [0137.480] FindClose (in: hFindFile=0x7a5fc28 | out: hFindFile=0x7a5fc28) returned 1 [0137.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0137.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0137.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0137.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", lpFilePart=0x0) returned 0x5a [0137.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0137.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\7awv7f.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.481] GetFileType (hFile=0x2e0) returned 0x1 [0137.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0137.481] GetFileType (hFile=0x2e0) returned 0x1 [0137.481] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x82ab [0137.481] ReadFile (in: hFile=0x2e0, lpBuffer=0x28208cc, nNumberOfBytesToRead=0x82ab, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x28208cc*, lpNumberOfBytesRead=0x8feaf8*=0x82ab, lpOverlapped=0x0) returned 1 [0137.482] CloseHandle (hObject=0x2e0) returned 1 [0137.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0137.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0137.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0137.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", lpFilePart=0x0) returned 0x5a [0137.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0137.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\7awv7f.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.658] GetFileType (hFile=0x2e0) returned 0x1 [0137.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0137.658] GetFileType (hFile=0x2e0) returned 0x1 [0137.658] WriteFile (in: hFile=0x2e0, lpBuffer=0x2896584*, nNumberOfBytesToWrite=0x82b0, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x2896584*, lpNumberOfBytesWritten=0x8feaec*=0x82b0, lpOverlapped=0x0) returned 1 [0137.660] CloseHandle (hObject=0x2e0) returned 1 [0137.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0137.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx", lpFilePart=0x0) returned 0x5a [0137.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0137.665] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx.rogue", nBufferLength=0x61, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx.rogue", lpFilePart=0x0) returned 0x60 [0137.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0137.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\7awv7f.pptx"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x592221d0, ftCreationTime.dwHighDateTime=0x1d5f01b, ftLastAccessTime.dwLowDateTime=0x647c5a30, ftLastAccessTime.dwHighDateTime=0x1d5e5ff, ftLastWriteTime.dwLowDateTime=0x5aca0737, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x82b0)) returned 1 [0137.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0137.665] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\7awv7f.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\7Awv7f.pptx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\7awv7f.pptx.rogue")) returned 1 [0137.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0137.666] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x68, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", lpFilePart=0x0) returned 0x67 [0137.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0137.666] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\903btdaag5paio5idmvg.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.667] GetFileType (hFile=0x2e0) returned 0x1 [0137.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0137.667] GetFileType (hFile=0x2e0) returned 0x1 [0137.667] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x29e0 [0137.667] ReadFile (in: hFile=0x2e0, lpBuffer=0x289eb04, nNumberOfBytesToRead=0x29e0, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x289eb04*, lpNumberOfBytesRead=0x8feaf8*=0x29e0, lpOverlapped=0x0) returned 1 [0137.667] CloseHandle (hObject=0x2e0) returned 1 [0137.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.758] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0137.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0137.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0137.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x68, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", lpFilePart=0x0) returned 0x67 [0137.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0137.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\903btdaag5paio5idmvg.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.761] GetFileType (hFile=0x2e0) returned 0x1 [0137.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0137.761] GetFileType (hFile=0x2e0) returned 0x1 [0137.761] WriteFile (in: hFile=0x2e0, lpBuffer=0x28f8a9c*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x28f8a9c*, lpNumberOfBytesWritten=0x8feaec*=0x29f0, lpOverlapped=0x0) returned 1 [0137.762] CloseHandle (hObject=0x2e0) returned 1 [0137.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x68 [0137.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", nBufferLength=0x68, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt", lpFilePart=0x0) returned 0x67 [0137.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6e [0137.764] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt.rogue", nBufferLength=0x6e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt.rogue", lpFilePart=0x0) returned 0x6d [0137.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0137.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\903btdaag5paio5idmvg.ppt"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d1c30, ftCreationTime.dwHighDateTime=0x1d5e0b3, ftLastAccessTime.dwLowDateTime=0x93a52940, ftLastAccessTime.dwHighDateTime=0x1d5ebf4, ftLastWriteTime.dwLowDateTime=0x5ad8520c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x29f0)) returned 1 [0137.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0137.764] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\903btdaag5paio5idmvg.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\903BtdaAG5pAio5iDmVg.ppt.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\903btdaag5paio5idmvg.ppt.rogue")) returned 1 [0137.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0137.765] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x5c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", lpFilePart=0x0) returned 0x5b [0137.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0137.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\hen0hmku.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.766] GetFileType (hFile=0x2e0) returned 0x1 [0137.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0137.766] GetFileType (hFile=0x2e0) returned 0x1 [0137.766] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x8dd6 [0137.766] ReadFile (in: hFile=0x2e0, lpBuffer=0x28fb778, nNumberOfBytesToRead=0x8dd6, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x28fb778*, lpNumberOfBytesRead=0x8feaf8*=0x8dd6, lpOverlapped=0x0) returned 1 [0137.767] CloseHandle (hObject=0x2e0) returned 1 [0137.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0137.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0137.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0137.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x5c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", lpFilePart=0x0) returned 0x5b [0137.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0137.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\hen0hmku.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.855] GetFileType (hFile=0x2e0) returned 0x1 [0137.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0137.855] GetFileType (hFile=0x2e0) returned 0x1 [0137.855] WriteFile (in: hFile=0x2e0, lpBuffer=0x2974ac4*, nNumberOfBytesToWrite=0x8de0, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x2974ac4*, lpNumberOfBytesWritten=0x8feaec*=0x8de0, lpOverlapped=0x0) returned 1 [0137.857] CloseHandle (hObject=0x2e0) returned 1 [0137.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0137.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", nBufferLength=0x5c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf", lpFilePart=0x0) returned 0x5b [0137.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0137.859] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf.rogue", nBufferLength=0x62, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf.rogue", lpFilePart=0x0) returned 0x61 [0137.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0137.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\hen0hmku.pdf"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x345ecd0, ftCreationTime.dwHighDateTime=0x1d5e664, ftLastAccessTime.dwLowDateTime=0xb59b630, ftLastAccessTime.dwHighDateTime=0x1d5e52f, ftLastWriteTime.dwLowDateTime=0x5ae6a02a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8de0)) returned 1 [0137.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0137.860] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\hen0hmku.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\heN0HmkU.pdf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\hen0hmku.pdf.rogue")) returned 1 [0137.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0137.861] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", lpFilePart=0x0) returned 0x64 [0137.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0137.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\k_hrs1sa zz40mphp.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.861] GetFileType (hFile=0x2e0) returned 0x1 [0137.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0137.861] GetFileType (hFile=0x2e0) returned 0x1 [0137.861] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x2a0d [0137.862] ReadFile (in: hFile=0x2e0, lpBuffer=0x297db88, nNumberOfBytesToRead=0x2a0d, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x297db88*, lpNumberOfBytesRead=0x8feaf8*=0x2a0d, lpOverlapped=0x0) returned 1 [0137.862] CloseHandle (hObject=0x2e0) returned 1 [0137.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0137.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0137.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0137.936] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0137.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0137.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0137.936] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", lpFilePart=0x0) returned 0x64 [0137.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0137.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\k_hrs1sa zz40mphp.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.938] GetFileType (hFile=0x2e0) returned 0x1 [0137.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0137.938] GetFileType (hFile=0x2e0) returned 0x1 [0137.938] WriteFile (in: hFile=0x2e0, lpBuffer=0x29d7bc4*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x29d7bc4*, lpNumberOfBytesWritten=0x8feaec*=0x2a10, lpOverlapped=0x0) returned 1 [0137.940] CloseHandle (hObject=0x2e0) returned 1 [0137.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0137.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf", lpFilePart=0x0) returned 0x64 [0137.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0137.941] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf.rogue", nBufferLength=0x6b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf.rogue", lpFilePart=0x0) returned 0x6a [0137.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0137.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\k_hrs1sa zz40mphp.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d06cc00, ftCreationTime.dwHighDateTime=0x1d5ea6f, ftLastAccessTime.dwLowDateTime=0xda412090, ftLastAccessTime.dwHighDateTime=0x1d5ea67, ftLastWriteTime.dwLowDateTime=0x5af28c9d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2a10)) returned 1 [0137.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0137.942] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\k_hrs1sa zz40mphp.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\K_hrS1sa ZZ40mPhp.rtf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\k_hrs1sa zz40mphp.rtf.rogue")) returned 1 [0137.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0137.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x64, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", lpFilePart=0x0) returned 0x63 [0137.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0137.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\wvv whcat0d5a 2e.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0137.943] GetFileType (hFile=0x2e0) returned 0x1 [0137.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0137.943] GetFileType (hFile=0x2e0) returned 0x1 [0137.943] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x4d79 [0137.947] ReadFile (in: hFile=0x2e0, lpBuffer=0x27e39a0, nNumberOfBytesToRead=0x4d79, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x27e39a0*, lpNumberOfBytesRead=0x8feaf8*=0x4d79, lpOverlapped=0x0) returned 1 [0137.947] CloseHandle (hObject=0x2e0) returned 1 [0138.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0138.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0138.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0138.260] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0138.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0138.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0138.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x64, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", lpFilePart=0x0) returned 0x63 [0138.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0138.261] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\wvv whcat0d5a 2e.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0138.262] GetFileType (hFile=0x2e0) returned 0x1 [0138.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0138.262] GetFileType (hFile=0x2e0) returned 0x1 [0138.262] WriteFile (in: hFile=0x2e0, lpBuffer=0x2848c68*, nNumberOfBytesToWrite=0x4d80, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x2848c68*, lpNumberOfBytesWritten=0x8feaec*=0x4d80, lpOverlapped=0x0) returned 1 [0138.264] CloseHandle (hObject=0x2e0) returned 1 [0138.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x64 [0138.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", nBufferLength=0x64, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls", lpFilePart=0x0) returned 0x63 [0138.265] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6a [0138.266] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls.rogue", nBufferLength=0x6a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls.rogue", lpFilePart=0x0) returned 0x69 [0138.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0138.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\wvv whcat0d5a 2e.xls"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9042af80, ftCreationTime.dwHighDateTime=0x1d5e18f, ftLastAccessTime.dwLowDateTime=0xe72ad730, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0x5b249e50, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x4d80)) returned 1 [0138.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0138.266] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\wvv whcat0d5a 2e.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\WVv WhcaT0D5a 2E.xls.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\wvv whcat0d5a 2e.xls.rogue")) returned 1 [0138.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0138.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", lpFilePart=0x0) returned 0x64 [0138.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0138.267] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\xcp 8ppvrzi0fmmog.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0138.267] GetFileType (hFile=0x2e0) returned 0x1 [0138.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0138.267] GetFileType (hFile=0x2e0) returned 0x1 [0138.267] GetFileSize (in: hFile=0x2e0, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0xeb8 [0138.267] ReadFile (in: hFile=0x2e0, lpBuffer=0x284eb98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x284eb98*, lpNumberOfBytesRead=0x8feaf8*=0xeb8, lpOverlapped=0x0) returned 1 [0138.268] CloseHandle (hObject=0x2e0) returned 1 [0138.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0138.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0138.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0138.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0138.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0138.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0138.292] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", lpFilePart=0x0) returned 0x64 [0138.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0138.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\xcp 8ppvrzi0fmmog.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2e0 [0138.294] GetFileType (hFile=0x2e0) returned 0x1 [0138.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0138.294] GetFileType (hFile=0x2e0) returned 0x1 [0138.294] WriteFile (in: hFile=0x2e0, lpBuffer=0x28a14a8*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x8feac0, lpOverlapped=0x0 | out: lpBuffer=0x28a14a8*, lpNumberOfBytesWritten=0x8feac0*=0xec0, lpOverlapped=0x0) returned 1 [0138.295] CloseHandle (hObject=0x2e0) returned 1 [0138.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x65 [0138.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", nBufferLength=0x65, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf", lpFilePart=0x0) returned 0x64 [0138.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x6b [0138.297] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf.rogue", nBufferLength=0x6b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf.rogue", lpFilePart=0x0) returned 0x6a [0138.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0138.297] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\xcp 8ppvrzi0fmmog.pdf"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d40060, ftCreationTime.dwHighDateTime=0x1d5ee2c, ftLastAccessTime.dwLowDateTime=0x973b1040, ftLastAccessTime.dwHighDateTime=0x1d5e2eb, ftLastWriteTime.dwLowDateTime=0x5b29621a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xec0)) returned 1 [0138.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0138.297] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\xcp 8ppvrzi0fmmog.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\BqTxvblrfPL pjZQxG\\EkpCXfmGLqSjksKt\\0YeBTtJHR0qkdxPU\\xCP 8pPvRZi0fmmOG.pdf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\bqtxvblrfpl pjzqxg\\ekpcxfmglqsjkskt\\0yebttjhr0qkdxpu\\xcp 8ppvrzi0fmmog.pdf.rogue")) returned 1 [0138.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0138.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0138.298] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0138.298] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0138.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec5c) returned 1 [0140.651] EtwEventRegister (in: ProviderId=0x28a499c, EnableCallback=0x4d43b06, CallbackContext=0x0, RegHandle=0x28a4978 | out: RegHandle=0x28a4978) returned 0x0 [0140.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0140.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0140.950] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0140.950] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec5c) returned 1 [0140.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0140.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0140.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0140.953] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5faa8 [0140.955] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.955] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.955] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0140.956] FindClose (in: hFindFile=0x7a5faa8 | out: hFindFile=0x7a5faa8) returned 1 [0140.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0140.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0140.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0140.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0140.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpFilePart=0x0) returned 0x23 [0140.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd68 [0140.957] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.957] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.957] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0140.957] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0140.957] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.957] FindClose (in: hFindFile=0x7a5fd68 | out: hFindFile=0x7a5fd68) returned 1 [0140.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0140.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0140.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0140.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0140.958] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0140.958] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd68 [0140.959] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.959] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0140.959] FindNextFileW (in: hFindFile=0x7a5fd68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.959] FindClose (in: hFindFile=0x7a5fd68 | out: hFindFile=0x7a5fd68) returned 1 [0140.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0140.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0140.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0140.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0140.959] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x2c [0140.960] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa28 [0140.960] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0140.960] FindClose (in: hFindFile=0x7a5fa28 | out: hFindFile=0x7a5fa28) returned 1 [0140.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0140.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0140.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0140.960] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0140.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0140.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0140.961] GetFileType (hFile=0x2cc) returned 0x1 [0140.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0140.961] GetFileType (hFile=0x2cc) returned 0x1 [0140.961] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0x74e6 [0140.961] ReadFile (in: hFile=0x2cc, lpBuffer=0x28a8884, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28a8884*, lpNumberOfBytesRead=0x8feb70*=0x74e6, lpOverlapped=0x0) returned 1 [0140.963] CloseHandle (hObject=0x2cc) returned 1 [0141.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0141.580] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0141.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0141.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0141.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0141.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0141.581] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x37 [0141.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0141.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0141.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fce50) returned 1 [0141.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0141.652] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0141.653] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0141.653] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0141.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec5c) returned 1 [0141.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0141.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0141.655] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0141.655] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f928 [0141.656] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.656] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0141.656] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0141.656] FindClose (in: hFindFile=0x7a5f928 | out: hFindFile=0x7a5f928) returned 1 [0141.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0141.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0141.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0141.657] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0141.657] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x27 [0141.657] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fde8 [0141.657] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.658] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0141.658] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0141.658] FindClose (in: hFindFile=0x7a5fde8 | out: hFindFile=0x7a5fde8) returned 1 [0141.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0141.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0141.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0141.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0141.658] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0", nBufferLength=0x1f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0", lpFilePart=0x0) returned 0x1e [0141.658] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fe28 [0141.659] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.659] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e9c950, ftCreationTime.dwHighDateTime=0x1d5ee46, ftLastAccessTime.dwLowDateTime=0x7c2f0090, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0x7c2f0090, ftLastWriteTime.dwHighDateTime=0x1d5f051, nFileSizeHigh=0x0, nFileSizeLow=0x541c, dwReserved0=0x0, dwReserved1=0x0, cFileName="-FbYN.xls", cAlternateFileName="")) returned 1 [0141.659] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x567d6ef0, ftCreationTime.dwHighDateTime=0x1d5ebfa, ftLastAccessTime.dwLowDateTime=0x18727950, ftLastAccessTime.dwHighDateTime=0x1d5ecec, ftLastWriteTime.dwLowDateTime=0x18727950, ftLastWriteTime.dwHighDateTime=0x1d5ecec, nFileSizeHigh=0x0, nFileSizeLow=0xe1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6k xL8w_2niYQ4kVM2G.pps", cAlternateFileName="6KXL8W~1.PPS")) returned 1 [0141.660] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc823d0, ftCreationTime.dwHighDateTime=0x1d5e73a, ftLastAccessTime.dwLowDateTime=0x57ca50e0, ftLastAccessTime.dwHighDateTime=0x1d5e360, ftLastWriteTime.dwLowDateTime=0x57ca50e0, ftLastWriteTime.dwHighDateTime=0x1d5e360, nFileSizeHigh=0x0, nFileSizeLow=0xce6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hehxC0c.docx", cAlternateFileName="HEHXC0~1.DOC")) returned 1 [0141.660] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb2caf80, ftCreationTime.dwHighDateTime=0x1d5e308, ftLastAccessTime.dwLowDateTime=0xb2658f40, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0xb2658f40, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0xff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IxbYiZ1dEvxwi.ods", cAlternateFileName="IXBYIZ~1.ODS")) returned 1 [0141.660] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8736550, ftCreationTime.dwHighDateTime=0x1d5e4c3, ftLastAccessTime.dwLowDateTime=0x388ce120, ftLastAccessTime.dwHighDateTime=0x1d5e842, ftLastWriteTime.dwLowDateTime=0x388ce120, ftLastWriteTime.dwHighDateTime=0x1d5e842, nFileSizeHigh=0x0, nFileSizeLow=0x2218, dwReserved0=0x0, dwReserved1=0x0, cFileName="WpQgVX3.ods", cAlternateFileName="")) returned 1 [0141.660] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bca6ad0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x37db4810, ftLastAccessTime.dwHighDateTime=0x1d5ee5b, ftLastWriteTime.dwLowDateTime=0x37db4810, ftLastWriteTime.dwHighDateTime=0x1d5ee5b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XQta8PZJkkXF.rtf", cAlternateFileName="XQTA8P~1.RTF")) returned 1 [0141.660] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0141.660] FindClose (in: hFindFile=0x7a5fe28 | out: hFindFile=0x7a5fe28) returned 1 [0141.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0141.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0141.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0141.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0141.661] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0", nBufferLength=0x1f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0", lpFilePart=0x0) returned 0x1e [0141.661] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fc68 [0141.662] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b4e8e0, ftCreationTime.dwHighDateTime=0x1d5e927, ftLastAccessTime.dwLowDateTime=0x86aaf280, ftLastAccessTime.dwHighDateTime=0x1d5e567, ftLastWriteTime.dwLowDateTime=0x86aaf280, ftLastWriteTime.dwHighDateTime=0x1d5e567, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.662] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e9c950, ftCreationTime.dwHighDateTime=0x1d5ee46, ftLastAccessTime.dwLowDateTime=0x7c2f0090, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0x7c2f0090, ftLastWriteTime.dwHighDateTime=0x1d5f051, nFileSizeHigh=0x0, nFileSizeLow=0x541c, dwReserved0=0x0, dwReserved1=0x0, cFileName="-FbYN.xls", cAlternateFileName="")) returned 1 [0141.662] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x567d6ef0, ftCreationTime.dwHighDateTime=0x1d5ebfa, ftLastAccessTime.dwLowDateTime=0x18727950, ftLastAccessTime.dwHighDateTime=0x1d5ecec, ftLastWriteTime.dwLowDateTime=0x18727950, ftLastWriteTime.dwHighDateTime=0x1d5ecec, nFileSizeHigh=0x0, nFileSizeLow=0xe1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="6k xL8w_2niYQ4kVM2G.pps", cAlternateFileName="6KXL8W~1.PPS")) returned 1 [0141.663] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc823d0, ftCreationTime.dwHighDateTime=0x1d5e73a, ftLastAccessTime.dwLowDateTime=0x57ca50e0, ftLastAccessTime.dwHighDateTime=0x1d5e360, ftLastWriteTime.dwLowDateTime=0x57ca50e0, ftLastWriteTime.dwHighDateTime=0x1d5e360, nFileSizeHigh=0x0, nFileSizeLow=0xce6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="hehxC0c.docx", cAlternateFileName="HEHXC0~1.DOC")) returned 1 [0141.663] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb2caf80, ftCreationTime.dwHighDateTime=0x1d5e308, ftLastAccessTime.dwLowDateTime=0xb2658f40, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0xb2658f40, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0xff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IxbYiZ1dEvxwi.ods", cAlternateFileName="IXBYIZ~1.ODS")) returned 1 [0141.663] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8736550, ftCreationTime.dwHighDateTime=0x1d5e4c3, ftLastAccessTime.dwLowDateTime=0x388ce120, ftLastAccessTime.dwHighDateTime=0x1d5e842, ftLastWriteTime.dwLowDateTime=0x388ce120, ftLastWriteTime.dwHighDateTime=0x1d5e842, nFileSizeHigh=0x0, nFileSizeLow=0x2218, dwReserved0=0x0, dwReserved1=0x0, cFileName="WpQgVX3.ods", cAlternateFileName="")) returned 1 [0141.663] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bca6ad0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x37db4810, ftLastAccessTime.dwHighDateTime=0x1d5ee5b, ftLastWriteTime.dwLowDateTime=0x37db4810, ftLastWriteTime.dwHighDateTime=0x1d5ee5b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XQta8PZJkkXF.rtf", cAlternateFileName="XQTA8P~1.RTF")) returned 1 [0141.663] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bca6ad0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x37db4810, ftLastAccessTime.dwHighDateTime=0x1d5ee5b, ftLastWriteTime.dwLowDateTime=0x37db4810, ftLastWriteTime.dwHighDateTime=0x1d5ee5b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XQta8PZJkkXF.rtf", cAlternateFileName="XQTA8P~1.RTF")) returned 0 [0141.664] FindClose (in: hFindFile=0x7a5fc68 | out: hFindFile=0x7a5fc68) returned 1 [0141.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0141.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0141.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0141.664] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", lpFilePart=0x0) returned 0x28 [0141.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0141.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\-fbyn.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0141.664] GetFileType (hFile=0x2cc) returned 0x1 [0141.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0141.665] GetFileType (hFile=0x2cc) returned 0x1 [0141.665] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x541c [0141.665] ReadFile (in: hFile=0x2cc, lpBuffer=0x2924814, nNumberOfBytesToRead=0x541c, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x2924814*, lpNumberOfBytesRead=0x8febe8*=0x541c, lpOverlapped=0x0) returned 1 [0141.666] CloseHandle (hObject=0x2cc) returned 1 [0141.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0141.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0141.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0141.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0141.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0141.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0141.875] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", lpFilePart=0x0) returned 0x28 [0141.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0141.875] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\-fbyn.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0141.876] GetFileType (hFile=0x2cc) returned 0x1 [0141.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0141.877] GetFileType (hFile=0x2cc) returned 0x1 [0141.877] WriteFile (in: hFile=0x2cc, lpBuffer=0x298ba9c*, nNumberOfBytesToWrite=0x5420, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x298ba9c*, lpNumberOfBytesWritten=0x8febdc*=0x5420, lpOverlapped=0x0) returned 1 [0141.879] CloseHandle (hObject=0x2cc) returned 1 [0141.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0141.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls", lpFilePart=0x0) returned 0x28 [0141.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0141.890] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls.rogue", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls.rogue", lpFilePart=0x0) returned 0x2e [0141.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0141.890] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\-fbyn.xls"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e9c950, ftCreationTime.dwHighDateTime=0x1d5ee46, ftLastAccessTime.dwLowDateTime=0x7c2f0090, ftLastAccessTime.dwHighDateTime=0x1d5f051, ftLastWriteTime.dwLowDateTime=0x5d4f2383, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5420)) returned 1 [0141.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0141.890] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\-fbyn.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\-FbYN.xls.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\-fbyn.xls.rogue")) returned 1 [0141.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0141.891] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", lpFilePart=0x0) returned 0x2b [0141.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0141.891] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\hehxc0c.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0141.892] GetFileType (hFile=0x2cc) returned 0x1 [0141.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0141.892] GetFileType (hFile=0x2cc) returned 0x1 [0141.892] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xce6b [0141.892] ReadFile (in: hFile=0x2cc, lpBuffer=0x2991124, nNumberOfBytesToRead=0xce6b, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x2991124*, lpNumberOfBytesRead=0x8febe8*=0xce6b, lpOverlapped=0x0) returned 1 [0141.893] CloseHandle (hObject=0x2cc) returned 1 [0142.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0142.056] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0142.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0142.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0142.057] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0142.058] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", lpFilePart=0x0) returned 0x2b [0142.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0142.058] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\hehxc0c.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.061] GetFileType (hFile=0x2cc) returned 0x1 [0142.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0142.061] GetFileType (hFile=0x2cc) returned 0x1 [0142.061] WriteFile (in: hFile=0x2cc, lpBuffer=0x28149ac*, nNumberOfBytesToWrite=0xce70, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28149ac*, lpNumberOfBytesWritten=0x8febdc*=0xce70, lpOverlapped=0x0) returned 1 [0142.064] CloseHandle (hObject=0x2cc) returned 1 [0142.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0142.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx", lpFilePart=0x0) returned 0x2b [0142.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0142.334] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx.rogue", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx.rogue", lpFilePart=0x0) returned 0x31 [0142.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0142.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\hehxc0c.docx"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dc823d0, ftCreationTime.dwHighDateTime=0x1d5e73a, ftLastAccessTime.dwLowDateTime=0x57ca50e0, ftLastAccessTime.dwHighDateTime=0x1d5e360, ftLastWriteTime.dwLowDateTime=0x5d92cede, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xce70)) returned 1 [0142.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0142.335] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\hehxc0c.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\hehxC0c.docx.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\hehxc0c.docx.rogue")) returned 1 [0142.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0142.337] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", lpFilePart=0x0) returned 0x2f [0142.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0142.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\xqta8pzjkkxf.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.337] GetFileType (hFile=0x2cc) returned 0x1 [0142.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0142.337] GetFileType (hFile=0x2cc) returned 0x1 [0142.337] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x639b [0142.337] ReadFile (in: hFile=0x2cc, lpBuffer=0x2821ab0, nNumberOfBytesToRead=0x639b, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x2821ab0*, lpNumberOfBytesRead=0x8febe8*=0x639b, lpOverlapped=0x0) returned 1 [0142.338] CloseHandle (hObject=0x2cc) returned 1 [0142.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0142.483] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0142.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0142.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0142.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0142.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", lpFilePart=0x0) returned 0x2f [0142.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0142.484] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\xqta8pzjkkxf.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.486] GetFileType (hFile=0x2cc) returned 0x1 [0142.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0142.486] GetFileType (hFile=0x2cc) returned 0x1 [0142.486] WriteFile (in: hFile=0x2cc, lpBuffer=0x288dc18*, nNumberOfBytesToWrite=0x63a0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x288dc18*, lpNumberOfBytesWritten=0x8febdc*=0x63a0, lpOverlapped=0x0) returned 1 [0142.488] CloseHandle (hObject=0x2cc) returned 1 [0142.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0142.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf", lpFilePart=0x0) returned 0x2f [0142.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0142.555] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf.rogue", nBufferLength=0x36, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf.rogue", lpFilePart=0x0) returned 0x35 [0142.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0142.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\xqta8pzjkkxf.rtf"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bca6ad0, ftCreationTime.dwHighDateTime=0x1d5e867, ftLastAccessTime.dwLowDateTime=0x37db4810, ftLastAccessTime.dwHighDateTime=0x1d5ee5b, ftLastWriteTime.dwLowDateTime=0x5db430c5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x63a0)) returned 1 [0142.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0142.556] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\xqta8pzjkkxf.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Rv_0\\XQta8PZJkkXF.rtf.rogue" (normalized: "c:\\users\\fd1hvy\\documents\\rv_0\\xqta8pzjkkxf.rtf.rogue")) returned 1 [0142.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0142.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0142.557] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0142.557] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fbe8 [0142.558] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.558] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.558] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0142.559] FindClose (in: hFindFile=0x7a5fbe8 | out: hFindFile=0x7a5fbe8) returned 1 [0142.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0142.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0142.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0142.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0142.559] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Downloads", lpFilePart=0x0) returned 0x19 [0142.559] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fde8 [0142.559] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.560] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.560] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0142.560] FindClose (in: hFindFile=0x7a5fde8 | out: hFindFile=0x7a5fde8) returned 1 [0142.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0142.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0142.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0142.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0142.560] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0142.561] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8bdc292, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8bdc292, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5faa8 [0142.561] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8bdc292, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8bdc292, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.561] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7aebf00, ftCreationTime.dwHighDateTime=0x1d5eaed, ftLastAccessTime.dwLowDateTime=0x92e584e0, ftLastAccessTime.dwHighDateTime=0x1d5ea56, ftLastWriteTime.dwLowDateTime=0x92e584e0, ftLastWriteTime.dwHighDateTime=0x1d5ea56, nFileSizeHigh=0x0, nFileSizeLow=0x10c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4mjfxV4cooSQ6D.gif", cAlternateFileName="4MJFXV~1.GIF")) returned 1 [0142.561] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e7f340, ftCreationTime.dwHighDateTime=0x1d5eba9, ftLastAccessTime.dwLowDateTime=0xf16a9e80, ftLastAccessTime.dwHighDateTime=0x1d5e67b, ftLastWriteTime.dwLowDateTime=0xf16a9e80, ftLastWriteTime.dwHighDateTime=0x1d5e67b, nFileSizeHigh=0x0, nFileSizeLow=0x16d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="64Fok4et-HsxWfBOXO1.bmp", cAlternateFileName="64FOK4~1.BMP")) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8052400, ftCreationTime.dwHighDateTime=0x1d5e5df, ftLastAccessTime.dwLowDateTime=0x85f80c50, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x85f80c50, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x57f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Fy-60V_JlAlz6g.png", cAlternateFileName="6FY-60~1.PNG")) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f90a520, ftCreationTime.dwHighDateTime=0x1d5ef6d, ftLastAccessTime.dwLowDateTime=0x74f7f1d0, ftLastAccessTime.dwHighDateTime=0x1d5e14f, ftLastWriteTime.dwLowDateTime=0x74f7f1d0, ftLastWriteTime.dwHighDateTime=0x1d5e14f, nFileSizeHigh=0x0, nFileSizeLow=0xb245, dwReserved0=0x0, dwReserved1=0x0, cFileName="a3eaOn62n.jpg", cAlternateFileName="A3EAON~1.JPG")) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2377a820, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xa97e8e00, ftLastAccessTime.dwHighDateTime=0x1d5e8ac, ftLastWriteTime.dwLowDateTime=0xa97e8e00, ftLastWriteTime.dwHighDateTime=0x1d5e8ac, nFileSizeHigh=0x0, nFileSizeLow=0x11095, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0nbEfQfgb.png", cAlternateFileName="B0NBEF~1.PNG")) returned 1 [0142.562] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d50930, ftCreationTime.dwHighDateTime=0x1d5e9a7, ftLastAccessTime.dwLowDateTime=0x3b678fb0, ftLastAccessTime.dwHighDateTime=0x1d5e371, ftLastWriteTime.dwLowDateTime=0x3b678fb0, ftLastWriteTime.dwHighDateTime=0x1d5e371, nFileSizeHigh=0x0, nFileSizeLow=0x17923, dwReserved0=0x0, dwReserved1=0x0, cFileName="bJo KGIIawqiyd FcJU.bmp", cAlternateFileName="BJOKGI~1.BMP")) returned 1 [0142.563] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c9ddd10, ftCreationTime.dwHighDateTime=0x1d5e88b, ftLastAccessTime.dwLowDateTime=0xc4732d0, ftLastAccessTime.dwHighDateTime=0x1d5ee98, ftLastWriteTime.dwLowDateTime=0xc4732d0, ftLastWriteTime.dwHighDateTime=0x1d5ee98, nFileSizeHigh=0x0, nFileSizeLow=0x16b5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOXYt.gif", cAlternateFileName="")) returned 1 [0142.563] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0142.563] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.563] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7e5b0, ftCreationTime.dwHighDateTime=0x1d5ef5a, ftLastAccessTime.dwLowDateTime=0x89de4f80, ftLastAccessTime.dwHighDateTime=0x1d5efd8, ftLastWriteTime.dwLowDateTime=0x89de4f80, ftLastWriteTime.dwHighDateTime=0x1d5efd8, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtvaPe_WqEAtjn5nqxv.gif", cAlternateFileName="DTVAPE~1.GIF")) returned 1 [0142.563] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrP4khIfl", cAlternateFileName="HRP4KH~1")) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefa4390, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x99e08fd0, ftLastAccessTime.dwHighDateTime=0x1d5e964, ftLastWriteTime.dwLowDateTime=0x99e08fd0, ftLastWriteTime.dwHighDateTime=0x1d5e964, nFileSizeHigh=0x0, nFileSizeLow=0x3f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="L8MOuq3Lo9Y92.png", cAlternateFileName="L8MOUQ~1.PNG")) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe820ca70, ftCreationTime.dwHighDateTime=0x1d5e13f, ftLastAccessTime.dwLowDateTime=0xd86f21e0, ftLastAccessTime.dwHighDateTime=0x1d5e323, ftLastWriteTime.dwLowDateTime=0xd86f21e0, ftLastWriteTime.dwHighDateTime=0x1d5e323, nFileSizeHigh=0x0, nFileSizeLow=0x17d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYz EQth-X_emhoey.png", cAlternateFileName="LYZEQT~1.PNG")) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cb5d10, ftCreationTime.dwHighDateTime=0x1d5ebed, ftLastAccessTime.dwLowDateTime=0x622e3ed0, ftLastAccessTime.dwHighDateTime=0x1d5e2ba, ftLastWriteTime.dwLowDateTime=0x622e3ed0, ftLastWriteTime.dwHighDateTime=0x1d5e2ba, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjokE0KRtXdwy.jpg", cAlternateFileName="MJOKE0~1.JPG")) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d8ec90, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x96b13f00, ftLastAccessTime.dwHighDateTime=0x1d5e84a, ftLastWriteTime.dwLowDateTime=0x96b13f00, ftLastWriteTime.dwHighDateTime=0x1d5e84a, nFileSizeHigh=0x0, nFileSizeLow=0x5c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFOqQD69 _IGFRK6Ax.jpg", cAlternateFileName="OFOQQD~1.JPG")) returned 1 [0142.564] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x928880c0, ftCreationTime.dwHighDateTime=0x1d5e253, ftLastAccessTime.dwLowDateTime=0x1d41950, ftLastAccessTime.dwHighDateTime=0x1d5ed33, ftLastWriteTime.dwLowDateTime=0x1d41950, ftLastWriteTime.dwHighDateTime=0x1d5ed33, nFileSizeHigh=0x0, nFileSizeLow=0x9ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="oI698SFR.gif", cAlternateFileName="")) returned 1 [0142.565] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa17a8580, ftCreationTime.dwHighDateTime=0x1d5e422, ftLastAccessTime.dwLowDateTime=0xb70144f0, ftLastAccessTime.dwHighDateTime=0x1d5e0af, ftLastWriteTime.dwLowDateTime=0xb70144f0, ftLastWriteTime.dwHighDateTime=0x1d5e0af, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pepL-A1zmzeNB7HE.png", cAlternateFileName="PEPL-A~1.PNG")) returned 1 [0142.565] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0142.565] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3cb2c80, ftCreationTime.dwHighDateTime=0x1d5eafd, ftLastAccessTime.dwLowDateTime=0x9015d8c0, ftLastAccessTime.dwHighDateTime=0x1d5e374, ftLastWriteTime.dwLowDateTime=0x9015d8c0, ftLastWriteTime.dwHighDateTime=0x1d5e374, nFileSizeHigh=0x0, nFileSizeLow=0xafcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsRkhMcJhk.png", cAlternateFileName="USRKHM~1.PNG")) returned 1 [0142.565] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ee1b60, ftCreationTime.dwHighDateTime=0x1d5e246, ftLastAccessTime.dwLowDateTime=0x110b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e0cf, ftLastWriteTime.dwLowDateTime=0x110b8f40, ftLastWriteTime.dwHighDateTime=0x1d5e0cf, nFileSizeHigh=0x0, nFileSizeLow=0x9fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="W_CCK1fZ x1Kxx.png", cAlternateFileName="W_CCK1~1.PNG")) returned 1 [0142.566] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae237dd0, ftCreationTime.dwHighDateTime=0x1d5e663, ftLastAccessTime.dwLowDateTime=0x45947d00, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0x45947d00, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0x7dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YoiOTxBa2.gif", cAlternateFileName="YOIOTX~1.GIF")) returned 1 [0142.566] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0142.567] FindClose (in: hFindFile=0x7a5faa8 | out: hFindFile=0x7a5faa8) returned 1 [0142.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0142.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0142.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0142.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0142.567] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures", lpFilePart=0x0) returned 0x18 [0142.568] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8bdc292, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8bdc292, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0142.568] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8bdc292, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8bdc292, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.568] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7aebf00, ftCreationTime.dwHighDateTime=0x1d5eaed, ftLastAccessTime.dwLowDateTime=0x92e584e0, ftLastAccessTime.dwHighDateTime=0x1d5ea56, ftLastWriteTime.dwLowDateTime=0x92e584e0, ftLastWriteTime.dwHighDateTime=0x1d5ea56, nFileSizeHigh=0x0, nFileSizeLow=0x10c2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="4mjfxV4cooSQ6D.gif", cAlternateFileName="4MJFXV~1.GIF")) returned 1 [0142.568] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e7f340, ftCreationTime.dwHighDateTime=0x1d5eba9, ftLastAccessTime.dwLowDateTime=0xf16a9e80, ftLastAccessTime.dwHighDateTime=0x1d5e67b, ftLastWriteTime.dwLowDateTime=0xf16a9e80, ftLastWriteTime.dwHighDateTime=0x1d5e67b, nFileSizeHigh=0x0, nFileSizeLow=0x16d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="64Fok4et-HsxWfBOXO1.bmp", cAlternateFileName="64FOK4~1.BMP")) returned 1 [0142.569] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8052400, ftCreationTime.dwHighDateTime=0x1d5e5df, ftLastAccessTime.dwLowDateTime=0x85f80c50, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x85f80c50, ftLastWriteTime.dwHighDateTime=0x1d5ecb1, nFileSizeHigh=0x0, nFileSizeLow=0x57f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Fy-60V_JlAlz6g.png", cAlternateFileName="6FY-60~1.PNG")) returned 1 [0142.569] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f90a520, ftCreationTime.dwHighDateTime=0x1d5ef6d, ftLastAccessTime.dwLowDateTime=0x74f7f1d0, ftLastAccessTime.dwHighDateTime=0x1d5e14f, ftLastWriteTime.dwLowDateTime=0x74f7f1d0, ftLastWriteTime.dwHighDateTime=0x1d5e14f, nFileSizeHigh=0x0, nFileSizeLow=0xb245, dwReserved0=0x0, dwReserved1=0x0, cFileName="a3eaOn62n.jpg", cAlternateFileName="A3EAON~1.JPG")) returned 1 [0142.569] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2377a820, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xa97e8e00, ftLastAccessTime.dwHighDateTime=0x1d5e8ac, ftLastWriteTime.dwLowDateTime=0xa97e8e00, ftLastWriteTime.dwHighDateTime=0x1d5e8ac, nFileSizeHigh=0x0, nFileSizeLow=0x11095, dwReserved0=0x0, dwReserved1=0x0, cFileName="b0nbEfQfgb.png", cAlternateFileName="B0NBEF~1.PNG")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d50930, ftCreationTime.dwHighDateTime=0x1d5e9a7, ftLastAccessTime.dwLowDateTime=0x3b678fb0, ftLastAccessTime.dwHighDateTime=0x1d5e371, ftLastWriteTime.dwLowDateTime=0x3b678fb0, ftLastWriteTime.dwHighDateTime=0x1d5e371, nFileSizeHigh=0x0, nFileSizeLow=0x17923, dwReserved0=0x0, dwReserved1=0x0, cFileName="bJo KGIIawqiyd FcJU.bmp", cAlternateFileName="BJOKGI~1.BMP")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c9ddd10, ftCreationTime.dwHighDateTime=0x1d5e88b, ftLastAccessTime.dwLowDateTime=0xc4732d0, ftLastAccessTime.dwHighDateTime=0x1d5ee98, ftLastWriteTime.dwLowDateTime=0xc4732d0, ftLastWriteTime.dwHighDateTime=0x1d5ee98, nFileSizeHigh=0x0, nFileSizeLow=0x16b5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOXYt.gif", cAlternateFileName="")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0142.570] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.571] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e7e5b0, ftCreationTime.dwHighDateTime=0x1d5ef5a, ftLastAccessTime.dwLowDateTime=0x89de4f80, ftLastAccessTime.dwHighDateTime=0x1d5efd8, ftLastWriteTime.dwLowDateTime=0x89de4f80, ftLastWriteTime.dwHighDateTime=0x1d5efd8, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtvaPe_WqEAtjn5nqxv.gif", cAlternateFileName="DTVAPE~1.GIF")) returned 1 [0142.571] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hrP4khIfl", cAlternateFileName="HRP4KH~1")) returned 1 [0142.571] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefa4390, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x99e08fd0, ftLastAccessTime.dwHighDateTime=0x1d5e964, ftLastWriteTime.dwLowDateTime=0x99e08fd0, ftLastWriteTime.dwHighDateTime=0x1d5e964, nFileSizeHigh=0x0, nFileSizeLow=0x3f24, dwReserved0=0x0, dwReserved1=0x0, cFileName="L8MOuq3Lo9Y92.png", cAlternateFileName="L8MOUQ~1.PNG")) returned 1 [0142.571] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe820ca70, ftCreationTime.dwHighDateTime=0x1d5e13f, ftLastAccessTime.dwLowDateTime=0xd86f21e0, ftLastAccessTime.dwHighDateTime=0x1d5e323, ftLastWriteTime.dwLowDateTime=0xd86f21e0, ftLastWriteTime.dwHighDateTime=0x1d5e323, nFileSizeHigh=0x0, nFileSizeLow=0x17d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYz EQth-X_emhoey.png", cAlternateFileName="LYZEQT~1.PNG")) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cb5d10, ftCreationTime.dwHighDateTime=0x1d5ebed, ftLastAccessTime.dwLowDateTime=0x622e3ed0, ftLastAccessTime.dwHighDateTime=0x1d5e2ba, ftLastWriteTime.dwLowDateTime=0x622e3ed0, ftLastWriteTime.dwHighDateTime=0x1d5e2ba, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="MjokE0KRtXdwy.jpg", cAlternateFileName="MJOKE0~1.JPG")) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d8ec90, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x96b13f00, ftLastAccessTime.dwHighDateTime=0x1d5e84a, ftLastWriteTime.dwLowDateTime=0x96b13f00, ftLastWriteTime.dwHighDateTime=0x1d5e84a, nFileSizeHigh=0x0, nFileSizeLow=0x5c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFOqQD69 _IGFRK6Ax.jpg", cAlternateFileName="OFOQQD~1.JPG")) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x928880c0, ftCreationTime.dwHighDateTime=0x1d5e253, ftLastAccessTime.dwLowDateTime=0x1d41950, ftLastAccessTime.dwHighDateTime=0x1d5ed33, ftLastWriteTime.dwLowDateTime=0x1d41950, ftLastWriteTime.dwHighDateTime=0x1d5ed33, nFileSizeHigh=0x0, nFileSizeLow=0x9ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="oI698SFR.gif", cAlternateFileName="")) returned 1 [0142.572] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa17a8580, ftCreationTime.dwHighDateTime=0x1d5e422, ftLastAccessTime.dwLowDateTime=0xb70144f0, ftLastAccessTime.dwHighDateTime=0x1d5e0af, ftLastWriteTime.dwLowDateTime=0xb70144f0, ftLastWriteTime.dwHighDateTime=0x1d5e0af, nFileSizeHigh=0x0, nFileSizeLow=0x14c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pepL-A1zmzeNB7HE.png", cAlternateFileName="PEPL-A~1.PNG")) returned 1 [0142.573] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0142.573] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3cb2c80, ftCreationTime.dwHighDateTime=0x1d5eafd, ftLastAccessTime.dwLowDateTime=0x9015d8c0, ftLastAccessTime.dwHighDateTime=0x1d5e374, ftLastWriteTime.dwLowDateTime=0x9015d8c0, ftLastWriteTime.dwHighDateTime=0x1d5e374, nFileSizeHigh=0x0, nFileSizeLow=0xafcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsRkhMcJhk.png", cAlternateFileName="USRKHM~1.PNG")) returned 1 [0142.573] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ee1b60, ftCreationTime.dwHighDateTime=0x1d5e246, ftLastAccessTime.dwLowDateTime=0x110b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e0cf, ftLastWriteTime.dwLowDateTime=0x110b8f40, ftLastWriteTime.dwHighDateTime=0x1d5e0cf, nFileSizeHigh=0x0, nFileSizeLow=0x9fc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="W_CCK1fZ x1Kxx.png", cAlternateFileName="W_CCK1~1.PNG")) returned 1 [0142.573] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae237dd0, ftCreationTime.dwHighDateTime=0x1d5e663, ftLastAccessTime.dwLowDateTime=0x45947d00, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0x45947d00, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0x7dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YoiOTxBa2.gif", cAlternateFileName="YOIOTX~1.GIF")) returned 1 [0142.574] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae237dd0, ftCreationTime.dwHighDateTime=0x1d5e663, ftLastAccessTime.dwLowDateTime=0x45947d00, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0x45947d00, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0x7dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="YoiOTxBa2.gif", cAlternateFileName="YOIOTX~1.GIF")) returned 0 [0142.574] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0142.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0142.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0142.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0142.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", lpFilePart=0x0) returned 0x30 [0142.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0142.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64fok4et-hsxwfboxo1.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.575] GetFileType (hFile=0x2cc) returned 0x1 [0142.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0142.575] GetFileType (hFile=0x2cc) returned 0x1 [0142.575] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x16d3f [0142.576] ReadFile (in: hFile=0x2cc, lpBuffer=0x38c37a8, nNumberOfBytesToRead=0x16d3f, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x38c37a8*, lpNumberOfBytesRead=0x8fec60*=0x16d3f, lpOverlapped=0x0) returned 1 [0142.578] CloseHandle (hObject=0x2cc) returned 1 [0142.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0142.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0142.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0142.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0142.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0142.761] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", lpFilePart=0x0) returned 0x30 [0142.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0142.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64fok4et-hsxwfboxo1.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.763] GetFileType (hFile=0x2cc) returned 0x1 [0142.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0142.763] GetFileType (hFile=0x2cc) returned 0x1 [0142.763] WriteFile (in: hFile=0x2cc, lpBuffer=0x3935a28*, nNumberOfBytesToWrite=0x16d40, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x3935a28*, lpNumberOfBytesWritten=0x8fec54*=0x16d40, lpOverlapped=0x0) returned 1 [0142.765] CloseHandle (hObject=0x2cc) returned 1 [0142.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0142.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp", lpFilePart=0x0) returned 0x30 [0142.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0142.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp.rogue", lpFilePart=0x0) returned 0x36 [0142.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0142.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64fok4et-hsxwfboxo1.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81e7f340, ftCreationTime.dwHighDateTime=0x1d5eba9, ftLastAccessTime.dwLowDateTime=0xf16a9e80, ftLastAccessTime.dwHighDateTime=0x1d5e67b, ftLastWriteTime.dwLowDateTime=0x5dd32f35, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16d40)) returned 1 [0142.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0142.769] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\64fok4et-hsxwfboxo1.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\64Fok4et-HsxWfBOXO1.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\64fok4et-hsxwfboxo1.bmp.rogue")) returned 1 [0142.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0142.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", lpFilePart=0x0) returned 0x2c [0142.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0142.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fy-60v_jlalz6g.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.771] GetFileType (hFile=0x2cc) returned 0x1 [0142.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0142.771] GetFileType (hFile=0x2cc) returned 0x1 [0142.771] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x57f1 [0142.772] ReadFile (in: hFile=0x2cc, lpBuffer=0x28e5eac, nNumberOfBytesToRead=0x57f1, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28e5eac*, lpNumberOfBytesRead=0x8fec60*=0x57f1, lpOverlapped=0x0) returned 1 [0142.772] CloseHandle (hObject=0x2cc) returned 1 [0142.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0142.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0142.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0142.874] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0142.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0142.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", lpFilePart=0x0) returned 0x2c [0142.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0142.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fy-60v_jlalz6g.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.876] GetFileType (hFile=0x2cc) returned 0x1 [0142.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0142.876] GetFileType (hFile=0x2cc) returned 0x1 [0142.876] WriteFile (in: hFile=0x2cc, lpBuffer=0x294e498*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x294e498*, lpNumberOfBytesWritten=0x8fec54*=0x5800, lpOverlapped=0x0) returned 1 [0142.878] CloseHandle (hObject=0x2cc) returned 1 [0142.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0142.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png", lpFilePart=0x0) returned 0x2c [0142.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0142.880] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png.rogue", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png.rogue", lpFilePart=0x0) returned 0x32 [0142.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0142.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fy-60v_jlalz6g.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8052400, ftCreationTime.dwHighDateTime=0x1d5e5df, ftLastAccessTime.dwLowDateTime=0x85f80c50, ftLastAccessTime.dwHighDateTime=0x1d5ecb1, ftLastWriteTime.dwLowDateTime=0x5de6587c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5800)) returned 1 [0142.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0142.881] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png" (normalized: "c:\\users\\fd1hvy\\pictures\\6fy-60v_jlalz6g.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6Fy-60V_JlAlz6g.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\6fy-60v_jlalz6g.png.rogue")) returned 1 [0142.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0142.881] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", lpFilePart=0x0) returned 0x26 [0142.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0142.881] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a3eaon62n.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.882] GetFileType (hFile=0x2cc) returned 0x1 [0142.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0142.882] GetFileType (hFile=0x2cc) returned 0x1 [0142.882] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xb245 [0142.882] ReadFile (in: hFile=0x2cc, lpBuffer=0x2953f04, nNumberOfBytesToRead=0xb245, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2953f04*, lpNumberOfBytesRead=0x8fec60*=0xb245, lpOverlapped=0x0) returned 1 [0142.882] CloseHandle (hObject=0x2cc) returned 1 [0142.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0142.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0142.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0142.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0142.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0142.901] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", lpFilePart=0x0) returned 0x26 [0142.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0142.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a3eaon62n.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.903] GetFileType (hFile=0x2cc) returned 0x1 [0142.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0142.903] GetFileType (hFile=0x2cc) returned 0x1 [0142.903] WriteFile (in: hFile=0x2cc, lpBuffer=0x29c23f4*, nNumberOfBytesToWrite=0xb250, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29c23f4*, lpNumberOfBytesWritten=0x8fec54*=0xb250, lpOverlapped=0x0) returned 1 [0142.905] CloseHandle (hObject=0x2cc) returned 1 [0142.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0142.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg", lpFilePart=0x0) returned 0x26 [0142.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0142.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg.rogue", nBufferLength=0x2d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg.rogue", lpFilePart=0x0) returned 0x2c [0142.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0142.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a3eaon62n.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f90a520, ftCreationTime.dwHighDateTime=0x1d5ef6d, ftLastAccessTime.dwLowDateTime=0x74f7f1d0, ftLastAccessTime.dwHighDateTime=0x1d5e14f, ftLastWriteTime.dwLowDateTime=0x5de8a3db, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb250)) returned 1 [0142.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0142.907] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a3eaon62n.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\a3eaOn62n.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\a3eaon62n.jpg.rogue")) returned 1 [0142.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0142.908] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", lpFilePart=0x0) returned 0x27 [0142.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0142.908] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0nbefqfgb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0142.909] GetFileType (hFile=0x2cc) returned 0x1 [0142.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0142.909] GetFileType (hFile=0x2cc) returned 0x1 [0142.909] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x11095 [0142.909] ReadFile (in: hFile=0x2cc, lpBuffer=0x29cd89c, nNumberOfBytesToRead=0x11095, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29cd89c*, lpNumberOfBytesRead=0x8fec60*=0x11095, lpOverlapped=0x0) returned 1 [0142.909] CloseHandle (hObject=0x2cc) returned 1 [0143.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0143.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0143.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0143.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0143.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0143.344] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", lpFilePart=0x0) returned 0x27 [0143.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0143.344] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0nbefqfgb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.346] GetFileType (hFile=0x2cc) returned 0x1 [0143.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0143.346] GetFileType (hFile=0x2cc) returned 0x1 [0143.346] WriteFile (in: hFile=0x2cc, lpBuffer=0x2851f80*, nNumberOfBytesToWrite=0x110a0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2851f80*, lpNumberOfBytesWritten=0x8fec54*=0x110a0, lpOverlapped=0x0) returned 1 [0143.414] CloseHandle (hObject=0x2cc) returned 1 [0143.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0143.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png", lpFilePart=0x0) returned 0x27 [0143.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0143.417] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png.rogue", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png.rogue", lpFilePart=0x0) returned 0x2d [0143.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0143.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0nbefqfgb.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2377a820, ftCreationTime.dwHighDateTime=0x1d5e797, ftLastAccessTime.dwLowDateTime=0xa97e8e00, ftLastAccessTime.dwHighDateTime=0x1d5e8ac, ftLastWriteTime.dwLowDateTime=0x5e375171, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x110a0)) returned 1 [0143.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0143.418] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\b0nbefqfgb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\b0nbEfQfgb.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\b0nbefqfgb.png.rogue")) returned 1 [0143.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0143.419] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", lpFilePart=0x0) returned 0x30 [0143.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0143.419] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjo kgiiawqiyd fcju.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.419] GetFileType (hFile=0x2cc) returned 0x1 [0143.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0143.419] GetFileType (hFile=0x2cc) returned 0x1 [0143.419] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x17923 [0143.420] ReadFile (in: hFile=0x2cc, lpBuffer=0x3984d68, nNumberOfBytesToRead=0x17923, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x3984d68*, lpNumberOfBytesRead=0x8fec60*=0x17923, lpOverlapped=0x0) returned 1 [0143.422] CloseHandle (hObject=0x2cc) returned 1 [0143.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0143.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0143.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0143.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0143.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0143.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", lpFilePart=0x0) returned 0x30 [0143.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0143.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjo kgiiawqiyd fcju.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.452] GetFileType (hFile=0x2cc) returned 0x1 [0143.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0143.453] GetFileType (hFile=0x2cc) returned 0x1 [0143.453] WriteFile (in: hFile=0x2cc, lpBuffer=0x39fab88*, nNumberOfBytesToWrite=0x17930, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x39fab88*, lpNumberOfBytesWritten=0x8fec54*=0x17930, lpOverlapped=0x0) returned 1 [0143.455] CloseHandle (hObject=0x2cc) returned 1 [0143.506] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0143.506] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp", lpFilePart=0x0) returned 0x30 [0143.506] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0143.506] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp.rogue", lpFilePart=0x0) returned 0x36 [0143.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0143.506] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjo kgiiawqiyd fcju.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d50930, ftCreationTime.dwHighDateTime=0x1d5e9a7, ftLastAccessTime.dwLowDateTime=0x3b678fb0, ftLastAccessTime.dwHighDateTime=0x1d5e371, ftLastWriteTime.dwLowDateTime=0x5e459f7c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x17930)) returned 1 [0143.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0143.507] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjo kgiiawqiyd fcju.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bJo KGIIawqiyd FcJU.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\bjo kgiiawqiyd fcju.bmp.rogue")) returned 1 [0143.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", lpFilePart=0x0) returned 0x2a [0143.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0143.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l8mouq3lo9y92.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.514] GetFileType (hFile=0x2cc) returned 0x1 [0143.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0143.514] GetFileType (hFile=0x2cc) returned 0x1 [0143.514] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x3f24 [0143.514] ReadFile (in: hFile=0x2cc, lpBuffer=0x28b04b0, nNumberOfBytesToRead=0x3f24, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x28b04b0*, lpNumberOfBytesRead=0x8fec60*=0x3f24, lpOverlapped=0x0) returned 1 [0143.515] CloseHandle (hObject=0x2cc) returned 1 [0143.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0143.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0143.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0143.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0143.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.540] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", lpFilePart=0x0) returned 0x2a [0143.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0143.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l8mouq3lo9y92.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.542] GetFileType (hFile=0x2cc) returned 0x1 [0143.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0143.542] GetFileType (hFile=0x2cc) returned 0x1 [0143.542] WriteFile (in: hFile=0x2cc, lpBuffer=0x2910e88*, nNumberOfBytesToWrite=0x3f30, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2910e88*, lpNumberOfBytesWritten=0x8fec54*=0x3f30, lpOverlapped=0x0) returned 1 [0143.544] CloseHandle (hObject=0x2cc) returned 1 [0143.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png", lpFilePart=0x0) returned 0x2a [0143.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0143.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png.rogue", lpFilePart=0x0) returned 0x30 [0143.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0143.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l8mouq3lo9y92.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefa4390, ftCreationTime.dwHighDateTime=0x1d5e7ef, ftLastAccessTime.dwLowDateTime=0x99e08fd0, ftLastAccessTime.dwHighDateTime=0x1d5e964, ftLastWriteTime.dwLowDateTime=0x5e4a653a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x3f30)) returned 1 [0143.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0143.546] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png" (normalized: "c:\\users\\fd1hvy\\pictures\\l8mouq3lo9y92.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\L8MOuq3Lo9Y92.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\l8mouq3lo9y92.png.rogue")) returned 1 [0143.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0143.547] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", lpFilePart=0x0) returned 0x2e [0143.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0143.547] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lyz eqth-x_emhoey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.548] GetFileType (hFile=0x2cc) returned 0x1 [0143.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0143.548] GetFileType (hFile=0x2cc) returned 0x1 [0143.548] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x17d63 [0143.549] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a124d8, nNumberOfBytesToRead=0x17d63, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x3a124d8*, lpNumberOfBytesRead=0x8fec60*=0x17d63, lpOverlapped=0x0) returned 1 [0143.598] CloseHandle (hObject=0x2cc) returned 1 [0143.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0143.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0143.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0143.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0143.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0143.682] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", lpFilePart=0x0) returned 0x2e [0143.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0143.683] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lyz eqth-x_emhoey.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.685] GetFileType (hFile=0x2cc) returned 0x1 [0143.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0143.685] GetFileType (hFile=0x2cc) returned 0x1 [0143.685] WriteFile (in: hFile=0x2cc, lpBuffer=0x3a89838*, nNumberOfBytesToWrite=0x17d70, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x3a89838*, lpNumberOfBytesWritten=0x8fec54*=0x17d70, lpOverlapped=0x0) returned 1 [0143.688] CloseHandle (hObject=0x2cc) returned 1 [0143.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0143.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png", lpFilePart=0x0) returned 0x2e [0143.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0143.705] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png.rogue", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png.rogue", lpFilePart=0x0) returned 0x34 [0143.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0143.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lyz eqth-x_emhoey.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe820ca70, ftCreationTime.dwHighDateTime=0x1d5e13f, ftLastAccessTime.dwLowDateTime=0xd86f21e0, ftLastAccessTime.dwHighDateTime=0x1d5e323, ftLastWriteTime.dwLowDateTime=0x5e6252f2, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x17d70)) returned 1 [0143.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0143.705] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png" (normalized: "c:\\users\\fd1hvy\\pictures\\lyz eqth-x_emhoey.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\LYz EQth-X_emhoey.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\lyz eqth-x_emhoey.png.rogue")) returned 1 [0143.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.706] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", lpFilePart=0x0) returned 0x2a [0143.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0143.706] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mjoke0krtxdwy.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.707] GetFileType (hFile=0x2cc) returned 0x1 [0143.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0143.707] GetFileType (hFile=0x2cc) returned 0x1 [0143.708] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1653 [0143.708] ReadFile (in: hFile=0x2cc, lpBuffer=0x29620a4, nNumberOfBytesToRead=0x1653, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29620a4*, lpNumberOfBytesRead=0x8fec60*=0x1653, lpOverlapped=0x0) returned 1 [0143.708] CloseHandle (hObject=0x2cc) returned 1 [0143.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0143.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0143.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0143.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0143.778] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", lpFilePart=0x0) returned 0x2a [0143.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0143.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mjoke0krtxdwy.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.780] GetFileType (hFile=0x2cc) returned 0x1 [0143.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0143.780] GetFileType (hFile=0x2cc) returned 0x1 [0143.780] WriteFile (in: hFile=0x2cc, lpBuffer=0x29b5e70*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29b5e70*, lpNumberOfBytesWritten=0x8fec54*=0x1660, lpOverlapped=0x0) returned 1 [0143.782] CloseHandle (hObject=0x2cc) returned 1 [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg", lpFilePart=0x0) returned 0x2a [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0143.789] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg.rogue", lpFilePart=0x0) returned 0x30 [0143.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0143.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mjoke0krtxdwy.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cb5d10, ftCreationTime.dwHighDateTime=0x1d5ebed, ftLastAccessTime.dwLowDateTime=0x622e3ed0, ftLastAccessTime.dwHighDateTime=0x1d5e2ba, ftLastWriteTime.dwLowDateTime=0x5e710f45, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1660)) returned 1 [0143.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0143.790] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mjoke0krtxdwy.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\MjokE0KRtXdwy.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\mjoke0krtxdwy.jpg.rogue")) returned 1 [0143.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0143.791] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", lpFilePart=0x0) returned 0x2f [0143.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0143.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ofoqqd69 _igfrk6ax.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0143.791] GetFileType (hFile=0x2cc) returned 0x1 [0143.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0143.791] GetFileType (hFile=0x2cc) returned 0x1 [0143.791] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x5c2e [0143.791] ReadFile (in: hFile=0x2cc, lpBuffer=0x29b7748, nNumberOfBytesToRead=0x5c2e, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29b7748*, lpNumberOfBytesRead=0x8fec60*=0x5c2e, lpOverlapped=0x0) returned 1 [0143.792] CloseHandle (hObject=0x2cc) returned 1 [0144.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0144.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0144.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0144.032] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", lpFilePart=0x0) returned 0x2f [0144.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0144.033] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ofoqqd69 _igfrk6ax.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.035] GetFileType (hFile=0x2cc) returned 0x1 [0144.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0144.035] GetFileType (hFile=0x2cc) returned 0x1 [0144.035] WriteFile (in: hFile=0x2cc, lpBuffer=0x2815de8*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2815de8*, lpNumberOfBytesWritten=0x8fec54*=0x5c30, lpOverlapped=0x0) returned 1 [0144.037] CloseHandle (hObject=0x2cc) returned 1 [0144.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0144.039] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg", lpFilePart=0x0) returned 0x2f [0144.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0144.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg.rogue", nBufferLength=0x36, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg.rogue", lpFilePart=0x0) returned 0x35 [0144.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0144.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ofoqqd69 _igfrk6ax.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d8ec90, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x96b13f00, ftLastAccessTime.dwHighDateTime=0x1d5e84a, ftLastWriteTime.dwLowDateTime=0x5e96b0f7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x5c30)) returned 1 [0144.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0144.041] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ofoqqd69 _igfrk6ax.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\OFOqQD69 _IGFRK6Ax.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\ofoqqd69 _igfrk6ax.jpg.rogue")) returned 1 [0144.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0144.042] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", lpFilePart=0x0) returned 0x2d [0144.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0144.042] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pepl-a1zmzenb7he.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.042] GetFileType (hFile=0x2cc) returned 0x1 [0144.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0144.042] GetFileType (hFile=0x2cc) returned 0x1 [0144.042] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x14c00 [0144.043] ReadFile (in: hFile=0x2cc, lpBuffer=0x3aa15c8, nNumberOfBytesToRead=0x14c00, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x3aa15c8*, lpNumberOfBytesRead=0x8fec60*=0x14c00, lpOverlapped=0x0) returned 1 [0144.046] CloseHandle (hObject=0x2cc) returned 1 [0144.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0144.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0144.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0144.218] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", lpFilePart=0x0) returned 0x2d [0144.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0144.219] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pepl-a1zmzenb7he.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.221] GetFileType (hFile=0x2cc) returned 0x1 [0144.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0144.221] GetFileType (hFile=0x2cc) returned 0x1 [0144.222] WriteFile (in: hFile=0x2cc, lpBuffer=0x3808ac8*, nNumberOfBytesToWrite=0x14c10, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x3808ac8*, lpNumberOfBytesWritten=0x8fec54*=0x14c10, lpOverlapped=0x0) returned 1 [0144.226] CloseHandle (hObject=0x2cc) returned 1 [0144.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0144.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png", lpFilePart=0x0) returned 0x2d [0144.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0144.230] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png.rogue", nBufferLength=0x34, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png.rogue", lpFilePart=0x0) returned 0x33 [0144.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0144.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pepl-a1zmzenb7he.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa17a8580, ftCreationTime.dwHighDateTime=0x1d5e422, ftLastAccessTime.dwLowDateTime=0xb70144f0, ftLastAccessTime.dwHighDateTime=0x1d5e0af, ftLastWriteTime.dwLowDateTime=0x5eb34c0e, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14c10)) returned 1 [0144.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0144.230] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pepl-a1zmzenb7he.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\pepL-A1zmzeNB7HE.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\pepl-a1zmzenb7he.png.rogue")) returned 1 [0144.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0144.231] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", lpFilePart=0x0) returned 0x27 [0144.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0144.231] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png" (normalized: "c:\\users\\fd1hvy\\pictures\\usrkhmcjhk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.232] GetFileType (hFile=0x2cc) returned 0x1 [0144.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0144.232] GetFileType (hFile=0x2cc) returned 0x1 [0144.232] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0xafcd [0144.232] ReadFile (in: hFile=0x2cc, lpBuffer=0x27be85c, nNumberOfBytesToRead=0xafcd, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x27be85c*, lpNumberOfBytesRead=0x8fec60*=0xafcd, lpOverlapped=0x0) returned 1 [0144.233] CloseHandle (hObject=0x2cc) returned 1 [0144.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.469] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0144.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0144.470] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0144.470] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", lpFilePart=0x0) returned 0x27 [0144.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0144.470] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png" (normalized: "c:\\users\\fd1hvy\\pictures\\usrkhmcjhk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.536] GetFileType (hFile=0x2cc) returned 0x1 [0144.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0144.536] GetFileType (hFile=0x2cc) returned 0x1 [0144.536] WriteFile (in: hFile=0x2cc, lpBuffer=0x282c728*, nNumberOfBytesToWrite=0xafd0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x282c728*, lpNumberOfBytesWritten=0x8fec54*=0xafd0, lpOverlapped=0x0) returned 1 [0144.538] CloseHandle (hObject=0x2cc) returned 1 [0144.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0144.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png", lpFilePart=0x0) returned 0x27 [0144.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0144.545] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png.rogue", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png.rogue", lpFilePart=0x0) returned 0x2d [0144.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0144.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png" (normalized: "c:\\users\\fd1hvy\\pictures\\usrkhmcjhk.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3cb2c80, ftCreationTime.dwHighDateTime=0x1d5eafd, ftLastAccessTime.dwLowDateTime=0x9015d8c0, ftLastAccessTime.dwHighDateTime=0x1d5e374, ftLastWriteTime.dwLowDateTime=0x5ee2faf4, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xafd0)) returned 1 [0144.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0144.545] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png" (normalized: "c:\\users\\fd1hvy\\pictures\\usrkhmcjhk.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\UsRkhMcJhk.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\usrkhmcjhk.png.rogue")) returned 1 [0144.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.546] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", lpFilePart=0x0) returned 0x2b [0144.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0144.546] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w_cck1fz x1kxx.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.547] GetFileType (hFile=0x2cc) returned 0x1 [0144.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0144.547] GetFileType (hFile=0x2cc) returned 0x1 [0144.547] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x9fc4 [0144.547] ReadFile (in: hFile=0x2cc, lpBuffer=0x283795c, nNumberOfBytesToRead=0x9fc4, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x283795c*, lpNumberOfBytesRead=0x8fec60*=0x9fc4, lpOverlapped=0x0) returned 1 [0144.547] CloseHandle (hObject=0x2cc) returned 1 [0144.672] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.672] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0144.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0144.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.673] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", lpFilePart=0x0) returned 0x2b [0144.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0144.673] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w_cck1fz x1kxx.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.675] GetFileType (hFile=0x2cc) returned 0x1 [0144.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0144.675] GetFileType (hFile=0x2cc) returned 0x1 [0144.675] WriteFile (in: hFile=0x2cc, lpBuffer=0x28b6654*, nNumberOfBytesToWrite=0x9fd0, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x28b6654*, lpNumberOfBytesWritten=0x8fec54*=0x9fd0, lpOverlapped=0x0) returned 1 [0144.678] CloseHandle (hObject=0x2cc) returned 1 [0144.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0144.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png", lpFilePart=0x0) returned 0x2b [0144.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.681] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png.rogue", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png.rogue", lpFilePart=0x0) returned 0x31 [0144.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0144.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w_cck1fz x1kxx.png"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ee1b60, ftCreationTime.dwHighDateTime=0x1d5e246, ftLastAccessTime.dwLowDateTime=0x110b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e0cf, ftLastWriteTime.dwLowDateTime=0x5ef870a1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x9fd0)) returned 1 [0144.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0144.682] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png" (normalized: "c:\\users\\fd1hvy\\pictures\\w_cck1fz x1kxx.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\W_CCK1fZ x1Kxx.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\w_cck1fz x1kxx.png.rogue")) returned 1 [0144.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0144.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0144.683] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0144.683] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f768 [0144.684] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.684] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.685] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0144.685] FindClose (in: hFindFile=0x7a5f768 | out: hFindFile=0x7a5f768) returned 1 [0144.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0144.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0144.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0144.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0144.685] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x24 [0144.685] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fea8 [0144.686] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.686] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0144.686] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0144.686] FindClose (in: hFindFile=0x7a5fea8 | out: hFindFile=0x7a5fea8) returned 1 [0144.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0144.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0144.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0144.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0144.687] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", lpFilePart=0x0) returned 0x22 [0144.687] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fea8 [0144.687] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.687] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1100b0, ftCreationTime.dwHighDateTime=0x1d5e879, ftLastAccessTime.dwLowDateTime=0xfaea21c0, ftLastAccessTime.dwHighDateTime=0x1d5f10b, ftLastWriteTime.dwLowDateTime=0xfaea21c0, ftLastWriteTime.dwHighDateTime=0x1d5f10b, nFileSizeHigh=0x0, nFileSizeLow=0x14575, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AAGR2fKQk.jpg", cAlternateFileName="0AAGR2~1.JPG")) returned 1 [0144.687] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6247470, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0x7d2a8040, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x7d2a8040, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0xe61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5AO23glH5G.png", cAlternateFileName="5AO23G~1.PNG")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53043e00, ftCreationTime.dwHighDateTime=0x1d5e247, ftLastAccessTime.dwLowDateTime=0x62e0adb0, ftLastAccessTime.dwHighDateTime=0x1d5ee25, ftLastWriteTime.dwLowDateTime=0x62e0adb0, ftLastWriteTime.dwHighDateTime=0x1d5ee25, nFileSizeHigh=0x0, nFileSizeLow=0xb1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="5KCgt5m1d1.png", cAlternateFileName="5KCGT5~1.PNG")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14c466a0, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0xa34838b0, ftLastAccessTime.dwHighDateTime=0x1d5e3b6, ftLastWriteTime.dwLowDateTime=0xa34838b0, ftLastWriteTime.dwHighDateTime=0x1d5e3b6, nFileSizeHigh=0x0, nFileSizeLow=0xb132, dwReserved0=0x0, dwReserved1=0x0, cFileName="8mAnsBUF.bmp", cAlternateFileName="")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5235170, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0xca9d3c50, ftLastAccessTime.dwHighDateTime=0x1d5eada, ftLastWriteTime.dwLowDateTime=0xca9d3c50, ftLastWriteTime.dwHighDateTime=0x1d5eada, nFileSizeHigh=0x0, nFileSizeLow=0x105ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTh677q4w0IXqIi.bmp", cAlternateFileName="BTH677~1.BMP")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f669390, ftCreationTime.dwHighDateTime=0x1d5ee50, ftLastAccessTime.dwLowDateTime=0x80776490, ftLastAccessTime.dwHighDateTime=0x1d5e1eb, ftLastWriteTime.dwLowDateTime=0x80776490, ftLastWriteTime.dwHighDateTime=0x1d5e1eb, nFileSizeHigh=0x0, nFileSizeLow=0x6c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CF0Bv7IiKaUoW1Yd3UP.jpg", cAlternateFileName="CF0BV7~1.JPG")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cc80c0, ftCreationTime.dwHighDateTime=0x1d5eb0e, ftLastAccessTime.dwLowDateTime=0x2d045f60, ftLastAccessTime.dwHighDateTime=0x1d5ec14, ftLastWriteTime.dwLowDateTime=0x2d045f60, ftLastWriteTime.dwHighDateTime=0x1d5ec14, nFileSizeHigh=0x0, nFileSizeLow=0x550e, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5bXt3cI4.gif", cAlternateFileName="D5BXT3~1.GIF")) returned 1 [0144.688] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e32cd50, ftCreationTime.dwHighDateTime=0x1d5f032, ftLastAccessTime.dwLowDateTime=0x13f2a840, ftLastAccessTime.dwHighDateTime=0x1d5ef36, ftLastWriteTime.dwLowDateTime=0x13f2a840, ftLastWriteTime.dwHighDateTime=0x1d5ef36, nFileSizeHigh=0x0, nFileSizeLow=0x11576, dwReserved0=0x0, dwReserved1=0x0, cFileName="l2JYMdafL.png", cAlternateFileName="L2JYMD~1.PNG")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c3ff10, ftCreationTime.dwHighDateTime=0x1d5e9d5, ftLastAccessTime.dwLowDateTime=0xb1fd8b90, ftLastAccessTime.dwHighDateTime=0x1d5ec75, ftLastWriteTime.dwLowDateTime=0xb1fd8b90, ftLastWriteTime.dwHighDateTime=0x1d5ec75, nFileSizeHigh=0x0, nFileSizeLow=0x34d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP4MFdtVrE0.png", cAlternateFileName="MP4MFD~1.PNG")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461c3d20, ftCreationTime.dwHighDateTime=0x1d5e204, ftLastAccessTime.dwLowDateTime=0xe8067560, ftLastAccessTime.dwHighDateTime=0x1d5e123, ftLastWriteTime.dwLowDateTime=0xe8067560, ftLastWriteTime.dwHighDateTime=0x1d5e123, nFileSizeHigh=0x0, nFileSizeLow=0xb981, dwReserved0=0x0, dwReserved1=0x0, cFileName="o8vz2IFFr.png", cAlternateFileName="O8VZ2I~1.PNG")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2c514d0, ftCreationTime.dwHighDateTime=0x1d5ebed, ftLastAccessTime.dwLowDateTime=0x4aca7380, ftLastAccessTime.dwHighDateTime=0x1d5e805, ftLastWriteTime.dwLowDateTime=0x4aca7380, ftLastWriteTime.dwHighDateTime=0x1d5e805, nFileSizeHigh=0x0, nFileSizeLow=0x8959, dwReserved0=0x0, dwReserved1=0x0, cFileName="sYgz1L.gif", cAlternateFileName="")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2955600, ftCreationTime.dwHighDateTime=0x1d5f0f4, ftLastAccessTime.dwLowDateTime=0x58cd5370, ftLastAccessTime.dwHighDateTime=0x1d5e167, ftLastWriteTime.dwLowDateTime=0x58cd5370, ftLastWriteTime.dwHighDateTime=0x1d5e167, nFileSizeHigh=0x0, nFileSizeLow=0x58aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPJv07.png", cAlternateFileName="")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7301a790, ftCreationTime.dwHighDateTime=0x1d5e988, ftLastAccessTime.dwLowDateTime=0xef996220, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0xef996220, ftLastWriteTime.dwHighDateTime=0x1d5e695, nFileSizeHigh=0x0, nFileSizeLow=0x248f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIGQLXd7.bmp", cAlternateFileName="")) returned 1 [0144.689] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4299360, ftCreationTime.dwHighDateTime=0x1d5e485, ftLastAccessTime.dwLowDateTime=0x2df85ea0, ftLastAccessTime.dwHighDateTime=0x1d5ef7d, ftLastWriteTime.dwLowDateTime=0x2df85ea0, ftLastWriteTime.dwHighDateTime=0x1d5ef7d, nFileSizeHigh=0x0, nFileSizeLow=0x14c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCXQixz9T8neoDl.jpg", cAlternateFileName="YCXQIX~1.JPG")) returned 1 [0144.690] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a37810, ftCreationTime.dwHighDateTime=0x1d5e16f, ftLastAccessTime.dwLowDateTime=0x65f77d70, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0x65f77d70, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0x178d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEkxWI6p2S1h8qw5ex4.gif", cAlternateFileName="YEKXWI~1.GIF")) returned 1 [0144.690] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0144.690] FindClose (in: hFindFile=0x7a5fea8 | out: hFindFile=0x7a5fea8) returned 1 [0144.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0144.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0144.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0144.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x23 [0144.690] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", nBufferLength=0x23, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl", lpFilePart=0x0) returned 0x22 [0144.690] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fb68 [0144.691] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c4ceee0, ftCreationTime.dwHighDateTime=0x1d5ea69, ftLastAccessTime.dwLowDateTime=0x48f67590, ftLastAccessTime.dwHighDateTime=0x1d5eb20, ftLastWriteTime.dwLowDateTime=0x48f67590, ftLastWriteTime.dwHighDateTime=0x1d5eb20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.691] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1100b0, ftCreationTime.dwHighDateTime=0x1d5e879, ftLastAccessTime.dwLowDateTime=0xfaea21c0, ftLastAccessTime.dwHighDateTime=0x1d5f10b, ftLastWriteTime.dwLowDateTime=0xfaea21c0, ftLastWriteTime.dwHighDateTime=0x1d5f10b, nFileSizeHigh=0x0, nFileSizeLow=0x14575, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AAGR2fKQk.jpg", cAlternateFileName="0AAGR2~1.JPG")) returned 1 [0144.711] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6247470, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0x7d2a8040, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x7d2a8040, ftLastWriteTime.dwHighDateTime=0x1d5e51c, nFileSizeHigh=0x0, nFileSizeLow=0xe61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="5AO23glH5G.png", cAlternateFileName="5AO23G~1.PNG")) returned 1 [0144.711] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53043e00, ftCreationTime.dwHighDateTime=0x1d5e247, ftLastAccessTime.dwLowDateTime=0x62e0adb0, ftLastAccessTime.dwHighDateTime=0x1d5ee25, ftLastWriteTime.dwLowDateTime=0x62e0adb0, ftLastWriteTime.dwHighDateTime=0x1d5ee25, nFileSizeHigh=0x0, nFileSizeLow=0xb1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="5KCgt5m1d1.png", cAlternateFileName="5KCGT5~1.PNG")) returned 1 [0144.711] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14c466a0, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0xa34838b0, ftLastAccessTime.dwHighDateTime=0x1d5e3b6, ftLastWriteTime.dwLowDateTime=0xa34838b0, ftLastWriteTime.dwHighDateTime=0x1d5e3b6, nFileSizeHigh=0x0, nFileSizeLow=0xb132, dwReserved0=0x0, dwReserved1=0x0, cFileName="8mAnsBUF.bmp", cAlternateFileName="")) returned 1 [0144.712] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5235170, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0xca9d3c50, ftLastAccessTime.dwHighDateTime=0x1d5eada, ftLastWriteTime.dwLowDateTime=0xca9d3c50, ftLastWriteTime.dwHighDateTime=0x1d5eada, nFileSizeHigh=0x0, nFileSizeLow=0x105ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTh677q4w0IXqIi.bmp", cAlternateFileName="BTH677~1.BMP")) returned 1 [0144.712] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f669390, ftCreationTime.dwHighDateTime=0x1d5ee50, ftLastAccessTime.dwLowDateTime=0x80776490, ftLastAccessTime.dwHighDateTime=0x1d5e1eb, ftLastWriteTime.dwLowDateTime=0x80776490, ftLastWriteTime.dwHighDateTime=0x1d5e1eb, nFileSizeHigh=0x0, nFileSizeLow=0x6c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CF0Bv7IiKaUoW1Yd3UP.jpg", cAlternateFileName="CF0BV7~1.JPG")) returned 1 [0144.712] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7cc80c0, ftCreationTime.dwHighDateTime=0x1d5eb0e, ftLastAccessTime.dwLowDateTime=0x2d045f60, ftLastAccessTime.dwHighDateTime=0x1d5ec14, ftLastWriteTime.dwLowDateTime=0x2d045f60, ftLastWriteTime.dwHighDateTime=0x1d5ec14, nFileSizeHigh=0x0, nFileSizeLow=0x550e, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5bXt3cI4.gif", cAlternateFileName="D5BXT3~1.GIF")) returned 1 [0144.712] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e32cd50, ftCreationTime.dwHighDateTime=0x1d5f032, ftLastAccessTime.dwLowDateTime=0x13f2a840, ftLastAccessTime.dwHighDateTime=0x1d5ef36, ftLastWriteTime.dwLowDateTime=0x13f2a840, ftLastWriteTime.dwHighDateTime=0x1d5ef36, nFileSizeHigh=0x0, nFileSizeLow=0x11576, dwReserved0=0x0, dwReserved1=0x0, cFileName="l2JYMdafL.png", cAlternateFileName="L2JYMD~1.PNG")) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c3ff10, ftCreationTime.dwHighDateTime=0x1d5e9d5, ftLastAccessTime.dwLowDateTime=0xb1fd8b90, ftLastAccessTime.dwHighDateTime=0x1d5ec75, ftLastWriteTime.dwLowDateTime=0xb1fd8b90, ftLastWriteTime.dwHighDateTime=0x1d5ec75, nFileSizeHigh=0x0, nFileSizeLow=0x34d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MP4MFdtVrE0.png", cAlternateFileName="MP4MFD~1.PNG")) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461c3d20, ftCreationTime.dwHighDateTime=0x1d5e204, ftLastAccessTime.dwLowDateTime=0xe8067560, ftLastAccessTime.dwHighDateTime=0x1d5e123, ftLastWriteTime.dwLowDateTime=0xe8067560, ftLastWriteTime.dwHighDateTime=0x1d5e123, nFileSizeHigh=0x0, nFileSizeLow=0xb981, dwReserved0=0x0, dwReserved1=0x0, cFileName="o8vz2IFFr.png", cAlternateFileName="O8VZ2I~1.PNG")) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2c514d0, ftCreationTime.dwHighDateTime=0x1d5ebed, ftLastAccessTime.dwLowDateTime=0x4aca7380, ftLastAccessTime.dwHighDateTime=0x1d5e805, ftLastWriteTime.dwLowDateTime=0x4aca7380, ftLastWriteTime.dwHighDateTime=0x1d5e805, nFileSizeHigh=0x0, nFileSizeLow=0x8959, dwReserved0=0x0, dwReserved1=0x0, cFileName="sYgz1L.gif", cAlternateFileName="")) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2955600, ftCreationTime.dwHighDateTime=0x1d5f0f4, ftLastAccessTime.dwLowDateTime=0x58cd5370, ftLastAccessTime.dwHighDateTime=0x1d5e167, ftLastWriteTime.dwLowDateTime=0x58cd5370, ftLastWriteTime.dwHighDateTime=0x1d5e167, nFileSizeHigh=0x0, nFileSizeLow=0x58aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPJv07.png", cAlternateFileName="")) returned 1 [0144.713] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7301a790, ftCreationTime.dwHighDateTime=0x1d5e988, ftLastAccessTime.dwLowDateTime=0xef996220, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0xef996220, ftLastWriteTime.dwHighDateTime=0x1d5e695, nFileSizeHigh=0x0, nFileSizeLow=0x248f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIGQLXd7.bmp", cAlternateFileName="")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4299360, ftCreationTime.dwHighDateTime=0x1d5e485, ftLastAccessTime.dwLowDateTime=0x2df85ea0, ftLastAccessTime.dwHighDateTime=0x1d5ef7d, ftLastWriteTime.dwLowDateTime=0x2df85ea0, ftLastWriteTime.dwHighDateTime=0x1d5ef7d, nFileSizeHigh=0x0, nFileSizeLow=0x14c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="YCXQixz9T8neoDl.jpg", cAlternateFileName="YCXQIX~1.JPG")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a37810, ftCreationTime.dwHighDateTime=0x1d5e16f, ftLastAccessTime.dwLowDateTime=0x65f77d70, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0x65f77d70, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0x178d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEkxWI6p2S1h8qw5ex4.gif", cAlternateFileName="YEKXWI~1.GIF")) returned 1 [0144.714] FindNextFileW (in: hFindFile=0x7a5fb68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a37810, ftCreationTime.dwHighDateTime=0x1d5e16f, ftLastAccessTime.dwLowDateTime=0x65f77d70, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0x65f77d70, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0x178d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEkxWI6p2S1h8qw5ex4.gif", cAlternateFileName="YEKXWI~1.GIF")) returned 0 [0144.714] FindClose (in: hFindFile=0x7a5fb68 | out: hFindFile=0x7a5fb68) returned 1 [0144.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0144.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0144.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.715] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", lpFilePart=0x0) returned 0x31 [0144.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0144.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\0aagr2fkqk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.715] GetFileType (hFile=0x2cc) returned 0x1 [0144.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0144.716] GetFileType (hFile=0x2cc) returned 0x1 [0144.716] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x14575 [0144.716] ReadFile (in: hFile=0x2cc, lpBuffer=0x28c4b50, nNumberOfBytesToRead=0x14575, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28c4b50*, lpNumberOfBytesRead=0x8febe8*=0x14575, lpOverlapped=0x0) returned 1 [0144.717] CloseHandle (hObject=0x2cc) returned 1 [0144.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0144.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0144.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.804] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", lpFilePart=0x0) returned 0x31 [0144.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0144.804] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\0aagr2fkqk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.806] GetFileType (hFile=0x2cc) returned 0x1 [0144.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0144.807] GetFileType (hFile=0x2cc) returned 0x1 [0144.807] WriteFile (in: hFile=0x2cc, lpBuffer=0x294e9d0*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x294e9d0*, lpNumberOfBytesWritten=0x8febdc*=0x14580, lpOverlapped=0x0) returned 1 [0144.810] CloseHandle (hObject=0x2cc) returned 1 [0144.813] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg", lpFilePart=0x0) returned 0x31 [0144.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0144.814] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg.rogue", lpFilePart=0x0) returned 0x37 [0144.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0144.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\0aagr2fkqk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1100b0, ftCreationTime.dwHighDateTime=0x1d5e879, ftLastAccessTime.dwLowDateTime=0xfaea21c0, ftLastAccessTime.dwHighDateTime=0x1d5f10b, ftLastWriteTime.dwLowDateTime=0x5f0b82fb, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14580)) returned 1 [0144.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0144.814] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\0aagr2fkqk.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\0AAGR2fKQk.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\0aagr2fkqk.jpg.rogue")) returned 1 [0144.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.815] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", lpFilePart=0x0) returned 0x31 [0144.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0144.815] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5ao23glh5g.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.815] GetFileType (hFile=0x2cc) returned 0x1 [0144.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0144.815] GetFileType (hFile=0x2cc) returned 0x1 [0144.815] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xe61d [0144.815] ReadFile (in: hFile=0x2cc, lpBuffer=0x29631c0, nNumberOfBytesToRead=0xe61d, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x29631c0*, lpNumberOfBytesRead=0x8febe8*=0xe61d, lpOverlapped=0x0) returned 1 [0144.816] CloseHandle (hObject=0x2cc) returned 1 [0144.927] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0144.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0144.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0144.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0144.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0144.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.928] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", lpFilePart=0x0) returned 0x31 [0144.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0144.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5ao23glh5g.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.930] GetFileType (hFile=0x2cc) returned 0x1 [0144.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0144.930] GetFileType (hFile=0x2cc) returned 0x1 [0144.930] WriteFile (in: hFile=0x2cc, lpBuffer=0x27eaa44*, nNumberOfBytesToWrite=0xe620, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x27eaa44*, lpNumberOfBytesWritten=0x8febdc*=0xe620, lpOverlapped=0x0) returned 1 [0144.932] CloseHandle (hObject=0x2cc) returned 1 [0144.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png", lpFilePart=0x0) returned 0x31 [0144.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0144.934] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png.rogue", lpFilePart=0x0) returned 0x37 [0144.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0144.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5ao23glh5g.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6247470, ftCreationTime.dwHighDateTime=0x1d5ebbc, ftLastAccessTime.dwLowDateTime=0x7d2a8040, ftLastAccessTime.dwHighDateTime=0x1d5e51c, ftLastWriteTime.dwLowDateTime=0x5f1e958b, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xe620)) returned 1 [0144.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0144.935] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5ao23glh5g.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5AO23glH5G.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5ao23glh5g.png.rogue")) returned 1 [0144.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0144.935] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", lpFilePart=0x0) returned 0x31 [0144.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0144.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5kcgt5m1d1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0144.936] GetFileType (hFile=0x2cc) returned 0x1 [0144.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0144.936] GetFileType (hFile=0x2cc) returned 0x1 [0144.936] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xb1be [0144.936] ReadFile (in: hFile=0x2cc, lpBuffer=0x27f92d4, nNumberOfBytesToRead=0xb1be, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27f92d4*, lpNumberOfBytesRead=0x8febe8*=0xb1be, lpOverlapped=0x0) returned 1 [0144.936] CloseHandle (hObject=0x2cc) returned 1 [0145.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.126] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0145.126] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", lpFilePart=0x0) returned 0x31 [0145.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.126] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5kcgt5m1d1.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.129] GetFileType (hFile=0x2cc) returned 0x1 [0145.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.129] GetFileType (hFile=0x2cc) returned 0x1 [0145.129] WriteFile (in: hFile=0x2cc, lpBuffer=0x2867770*, nNumberOfBytesToWrite=0xb1c0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x2867770*, lpNumberOfBytesWritten=0x8febdc*=0xb1c0, lpOverlapped=0x0) returned 1 [0145.131] CloseHandle (hObject=0x2cc) returned 1 [0145.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0145.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png", lpFilePart=0x0) returned 0x31 [0145.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0145.134] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png.rogue", lpFilePart=0x0) returned 0x37 [0145.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5kcgt5m1d1.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53043e00, ftCreationTime.dwHighDateTime=0x1d5e247, ftLastAccessTime.dwLowDateTime=0x62e0adb0, ftLastAccessTime.dwHighDateTime=0x1d5ee25, ftLastWriteTime.dwLowDateTime=0x5f3d94e6, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb1c0)) returned 1 [0145.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.134] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5kcgt5m1d1.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\5KCgt5m1d1.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\5kcgt5m1d1.png.rogue")) returned 1 [0145.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0145.136] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", lpFilePart=0x0) returned 0x2f [0145.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\8mansbuf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.136] GetFileType (hFile=0x2cc) returned 0x1 [0145.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.136] GetFileType (hFile=0x2cc) returned 0x1 [0145.136] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xb132 [0145.136] ReadFile (in: hFile=0x2cc, lpBuffer=0x2872b9c, nNumberOfBytesToRead=0xb132, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x2872b9c*, lpNumberOfBytesRead=0x8febe8*=0xb132, lpOverlapped=0x0) returned 1 [0145.137] CloseHandle (hObject=0x2cc) returned 1 [0145.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.241] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.241] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0145.242] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", lpFilePart=0x0) returned 0x2f [0145.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\8mansbuf.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.244] GetFileType (hFile=0x2cc) returned 0x1 [0145.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.244] GetFileType (hFile=0x2cc) returned 0x1 [0145.244] WriteFile (in: hFile=0x2cc, lpBuffer=0x28e0d5c*, nNumberOfBytesToWrite=0xb140, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28e0d5c*, lpNumberOfBytesWritten=0x8febdc*=0xb140, lpOverlapped=0x0) returned 1 [0145.246] CloseHandle (hObject=0x2cc) returned 1 [0145.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0145.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp", lpFilePart=0x0) returned 0x2f [0145.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0145.248] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp.rogue", nBufferLength=0x36, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp.rogue", lpFilePart=0x0) returned 0x35 [0145.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.248] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\8mansbuf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14c466a0, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0xa34838b0, ftLastAccessTime.dwHighDateTime=0x1d5e3b6, ftLastWriteTime.dwLowDateTime=0x5f4e4574, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb140)) returned 1 [0145.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.248] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\8mansbuf.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\8mAnsBUF.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\8mansbuf.bmp.rogue")) returned 1 [0145.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0145.249] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", lpFilePart=0x0) returned 0x36 [0145.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\bth677q4w0ixqii.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.250] GetFileType (hFile=0x2cc) returned 0x1 [0145.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.250] GetFileType (hFile=0x2cc) returned 0x1 [0145.250] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x105ae [0145.250] ReadFile (in: hFile=0x2cc, lpBuffer=0x28ec10c, nNumberOfBytesToRead=0x105ae, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28ec10c*, lpNumberOfBytesRead=0x8febe8*=0x105ae, lpOverlapped=0x0) returned 1 [0145.251] CloseHandle (hObject=0x2cc) returned 1 [0145.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0145.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", lpFilePart=0x0) returned 0x36 [0145.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.281] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\bth677q4w0ixqii.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.283] GetFileType (hFile=0x2cc) returned 0x1 [0145.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.283] GetFileType (hFile=0x2cc) returned 0x1 [0145.283] WriteFile (in: hFile=0x2cc, lpBuffer=0x296a01c*, nNumberOfBytesToWrite=0x105b0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x296a01c*, lpNumberOfBytesWritten=0x8febdc*=0x105b0, lpOverlapped=0x0) returned 1 [0145.337] CloseHandle (hObject=0x2cc) returned 1 [0145.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0145.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp", lpFilePart=0x0) returned 0x36 [0145.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0145.341] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp.rogue", nBufferLength=0x3d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp.rogue", lpFilePart=0x0) returned 0x3c [0145.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\bth677q4w0ixqii.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5235170, ftCreationTime.dwHighDateTime=0x1d5e80e, ftLastAccessTime.dwLowDateTime=0xca9d3c50, ftLastAccessTime.dwHighDateTime=0x1d5eada, ftLastWriteTime.dwLowDateTime=0x5f5cbd17, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x105b0)) returned 1 [0145.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.342] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\bth677q4w0ixqii.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\BTh677q4w0IXqIi.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\bth677q4w0ixqii.bmp.rogue")) returned 1 [0145.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0145.343] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", lpFilePart=0x0) returned 0x3a [0145.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\cf0bv7iikauow1yd3up.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.343] GetFileType (hFile=0x2cc) returned 0x1 [0145.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.343] GetFileType (hFile=0x2cc) returned 0x1 [0145.343] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x6c9e [0145.343] ReadFile (in: hFile=0x2cc, lpBuffer=0x297a860, nNumberOfBytesToRead=0x6c9e, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x297a860*, lpNumberOfBytesRead=0x8febe8*=0x6c9e, lpOverlapped=0x0) returned 1 [0145.344] CloseHandle (hObject=0x2cc) returned 1 [0145.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.450] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0145.451] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", lpFilePart=0x0) returned 0x3a [0145.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\cf0bv7iikauow1yd3up.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.452] GetFileType (hFile=0x2cc) returned 0x1 [0145.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.453] GetFileType (hFile=0x2cc) returned 0x1 [0145.453] WriteFile (in: hFile=0x2cc, lpBuffer=0x27f0844*, nNumberOfBytesToWrite=0x6ca0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x27f0844*, lpNumberOfBytesWritten=0x8febdc*=0x6ca0, lpOverlapped=0x0) returned 1 [0145.455] CloseHandle (hObject=0x2cc) returned 1 [0145.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0145.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg", lpFilePart=0x0) returned 0x3a [0145.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0145.461] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg.rogue", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg.rogue", lpFilePart=0x0) returned 0x40 [0145.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\cf0bv7iikauow1yd3up.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f669390, ftCreationTime.dwHighDateTime=0x1d5ee50, ftLastAccessTime.dwLowDateTime=0x80776490, ftLastAccessTime.dwHighDateTime=0x1d5e1eb, ftLastWriteTime.dwLowDateTime=0x5f70384a, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x6ca0)) returned 1 [0145.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.461] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\cf0bv7iikauow1yd3up.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\CF0Bv7IiKaUoW1Yd3UP.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\cf0bv7iikauow1yd3up.jpg.rogue")) returned 1 [0145.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.462] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", lpFilePart=0x0) returned 0x30 [0145.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\l2jymdafl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.463] GetFileType (hFile=0x2cc) returned 0x1 [0145.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.463] GetFileType (hFile=0x2cc) returned 0x1 [0145.463] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x11576 [0145.463] ReadFile (in: hFile=0x2cc, lpBuffer=0x27f778c, nNumberOfBytesToRead=0x11576, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27f778c*, lpNumberOfBytesRead=0x8febe8*=0x11576, lpOverlapped=0x0) returned 1 [0145.464] CloseHandle (hObject=0x2cc) returned 1 [0145.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.564] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.565] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.565] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", lpFilePart=0x0) returned 0x30 [0145.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\l2jymdafl.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.568] GetFileType (hFile=0x2cc) returned 0x1 [0145.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.568] GetFileType (hFile=0x2cc) returned 0x1 [0145.568] WriteFile (in: hFile=0x2cc, lpBuffer=0x2878768*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x2878768*, lpNumberOfBytesWritten=0x8febdc*=0x11580, lpOverlapped=0x0) returned 1 [0145.571] CloseHandle (hObject=0x2cc) returned 1 [0145.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png", lpFilePart=0x0) returned 0x30 [0145.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0145.574] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png.rogue", lpFilePart=0x0) returned 0x36 [0145.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\l2jymdafl.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e32cd50, ftCreationTime.dwHighDateTime=0x1d5f032, ftLastAccessTime.dwLowDateTime=0x13f2a840, ftLastAccessTime.dwHighDateTime=0x1d5ef36, ftLastWriteTime.dwLowDateTime=0x5f805605, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x11580)) returned 1 [0145.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.575] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\l2jymdafl.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\l2JYMdafL.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\l2jymdafl.png.rogue")) returned 1 [0145.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0145.576] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", lpFilePart=0x0) returned 0x32 [0145.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\mp4mfdtvre0.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.576] GetFileType (hFile=0x2cc) returned 0x1 [0145.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.576] GetFileType (hFile=0x2cc) returned 0x1 [0145.576] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x34d7 [0145.576] ReadFile (in: hFile=0x2cc, lpBuffer=0x2889f54, nNumberOfBytesToRead=0x34d7, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x2889f54*, lpNumberOfBytesRead=0x8febe8*=0x34d7, lpOverlapped=0x0) returned 1 [0145.577] CloseHandle (hObject=0x2cc) returned 1 [0145.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.795] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0145.796] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", lpFilePart=0x0) returned 0x32 [0145.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\mp4mfdtvre0.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.798] GetFileType (hFile=0x2cc) returned 0x1 [0145.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.798] GetFileType (hFile=0x2cc) returned 0x1 [0145.798] WriteFile (in: hFile=0x2cc, lpBuffer=0x28e75a0*, nNumberOfBytesToWrite=0x34e0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28e75a0*, lpNumberOfBytesWritten=0x8febdc*=0x34e0, lpOverlapped=0x0) returned 1 [0145.800] CloseHandle (hObject=0x2cc) returned 1 [0145.801] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0145.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", nBufferLength=0x33, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png", lpFilePart=0x0) returned 0x32 [0145.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0145.802] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png.rogue", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png.rogue", lpFilePart=0x0) returned 0x38 [0145.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\mp4mfdtvre0.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c3ff10, ftCreationTime.dwHighDateTime=0x1d5e9d5, ftLastAccessTime.dwLowDateTime=0xb1fd8b90, ftLastAccessTime.dwHighDateTime=0x1d5ec75, ftLastWriteTime.dwLowDateTime=0x5fa3f436, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x34e0)) returned 1 [0145.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.802] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\mp4mfdtvre0.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\MP4MFdtVrE0.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\mp4mfdtvre0.png.rogue")) returned 1 [0145.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.803] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", lpFilePart=0x0) returned 0x30 [0145.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\o8vz2iffr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.803] GetFileType (hFile=0x2cc) returned 0x1 [0145.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.803] GetFileType (hFile=0x2cc) returned 0x1 [0145.803] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0xb981 [0145.804] ReadFile (in: hFile=0x2cc, lpBuffer=0x28eacf0, nNumberOfBytesToRead=0xb981, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x28eacf0*, lpNumberOfBytesRead=0x8febe8*=0xb981, lpOverlapped=0x0) returned 1 [0145.804] CloseHandle (hObject=0x2cc) returned 1 [0145.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", lpFilePart=0x0) returned 0x30 [0145.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\o8vz2iffr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.883] GetFileType (hFile=0x2cc) returned 0x1 [0145.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.883] GetFileType (hFile=0x2cc) returned 0x1 [0145.883] WriteFile (in: hFile=0x2cc, lpBuffer=0x295a7a0*, nNumberOfBytesToWrite=0xb990, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x295a7a0*, lpNumberOfBytesWritten=0x8febdc*=0xb990, lpOverlapped=0x0) returned 1 [0145.885] CloseHandle (hObject=0x2cc) returned 1 [0145.887] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0145.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png", lpFilePart=0x0) returned 0x30 [0145.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0145.888] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png.rogue", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png.rogue", lpFilePart=0x0) returned 0x36 [0145.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.888] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\o8vz2iffr.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x461c3d20, ftCreationTime.dwHighDateTime=0x1d5e204, ftLastAccessTime.dwLowDateTime=0xe8067560, ftLastAccessTime.dwHighDateTime=0x1d5e123, ftLastWriteTime.dwLowDateTime=0x5fafe1e1, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb990)) returned 1 [0145.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.888] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\o8vz2iffr.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\o8vz2IFFr.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\o8vz2iffr.png.rogue")) returned 1 [0145.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0145.889] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", lpFilePart=0x0) returned 0x2d [0145.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\upjv07.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.889] GetFileType (hFile=0x2cc) returned 0x1 [0145.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.889] GetFileType (hFile=0x2cc) returned 0x1 [0145.889] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x58aa [0145.890] ReadFile (in: hFile=0x2cc, lpBuffer=0x29663ac, nNumberOfBytesToRead=0x58aa, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x29663ac*, lpNumberOfBytesRead=0x8febe8*=0x58aa, lpOverlapped=0x0) returned 1 [0145.890] CloseHandle (hObject=0x2cc) returned 1 [0145.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0145.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0145.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0145.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0145.918] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0145.919] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", lpFilePart=0x0) returned 0x2d [0145.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0145.919] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\upjv07.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.920] GetFileType (hFile=0x2cc) returned 0x1 [0145.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0145.920] GetFileType (hFile=0x2cc) returned 0x1 [0145.920] WriteFile (in: hFile=0x2cc, lpBuffer=0x29ced08*, nNumberOfBytesToWrite=0x58b0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x29ced08*, lpNumberOfBytesWritten=0x8febdc*=0x58b0, lpOverlapped=0x0) returned 1 [0145.922] CloseHandle (hObject=0x2cc) returned 1 [0145.924] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0145.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", nBufferLength=0x2e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png", lpFilePart=0x0) returned 0x2d [0145.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0145.997] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png.rogue", nBufferLength=0x34, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png.rogue", lpFilePart=0x0) returned 0x33 [0145.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0145.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\upjv07.png"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2955600, ftCreationTime.dwHighDateTime=0x1d5f0f4, ftLastAccessTime.dwLowDateTime=0x58cd5370, ftLastAccessTime.dwHighDateTime=0x1d5e167, ftLastWriteTime.dwLowDateTime=0x5fb4a558, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x58b0)) returned 1 [0145.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0145.997] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\upjv07.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\UPJv07.png.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\upjv07.png.rogue")) returned 1 [0145.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0145.998] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", lpFilePart=0x0) returned 0x2f [0145.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0145.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\wigqlxd7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0145.999] GetFileType (hFile=0x2cc) returned 0x1 [0145.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0145.999] GetFileType (hFile=0x2cc) returned 0x1 [0145.999] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x248f [0146.003] ReadFile (in: hFile=0x2cc, lpBuffer=0x27e2b80, nNumberOfBytesToRead=0x248f, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27e2b80*, lpNumberOfBytesRead=0x8febe8*=0x248f, lpOverlapped=0x0) returned 1 [0146.003] CloseHandle (hObject=0x2cc) returned 1 [0146.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0146.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0146.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0146.408] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0146.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0146.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", lpFilePart=0x0) returned 0x2f [0146.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0146.409] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\wigqlxd7.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.411] GetFileType (hFile=0x2cc) returned 0x1 [0146.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0146.411] GetFileType (hFile=0x2cc) returned 0x1 [0146.411] WriteFile (in: hFile=0x2cc, lpBuffer=0x283b198*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x283b198*, lpNumberOfBytesWritten=0x8febdc*=0x2490, lpOverlapped=0x0) returned 1 [0146.413] CloseHandle (hObject=0x2cc) returned 1 [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp", lpFilePart=0x0) returned 0x2f [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0146.416] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp.rogue", nBufferLength=0x36, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp.rogue", lpFilePart=0x0) returned 0x35 [0146.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0146.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\wigqlxd7.bmp"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7301a790, ftCreationTime.dwHighDateTime=0x1d5e988, ftLastAccessTime.dwLowDateTime=0xef996220, ftLastAccessTime.dwHighDateTime=0x1d5e695, ftLastWriteTime.dwLowDateTime=0x6000f0ba, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2490)) returned 1 [0146.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0146.417] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\wigqlxd7.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\WIGQLXd7.bmp.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\wigqlxd7.bmp.rogue")) returned 1 [0146.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0146.418] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", lpFilePart=0x0) returned 0x36 [0146.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0146.418] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\ycxqixz9t8neodl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.418] GetFileType (hFile=0x2cc) returned 0x1 [0146.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0146.418] GetFileType (hFile=0x2cc) returned 0x1 [0146.418] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x14c87 [0146.418] ReadFile (in: hFile=0x2cc, lpBuffer=0x38ffd58, nNumberOfBytesToRead=0x14c87, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x38ffd58*, lpNumberOfBytesRead=0x8febe8*=0x14c87, lpOverlapped=0x0) returned 1 [0146.419] CloseHandle (hObject=0x2cc) returned 1 [0146.500] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0146.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0146.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0146.501] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0146.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0146.501] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", lpFilePart=0x0) returned 0x36 [0146.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0146.501] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\ycxqixz9t8neodl.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.504] GetFileType (hFile=0x2cc) returned 0x1 [0146.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0146.504] GetFileType (hFile=0x2cc) returned 0x1 [0146.504] WriteFile (in: hFile=0x2cc, lpBuffer=0x3967c60*, nNumberOfBytesToWrite=0x14c90, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x3967c60*, lpNumberOfBytesWritten=0x8febdc*=0x14c90, lpOverlapped=0x0) returned 1 [0146.506] CloseHandle (hObject=0x2cc) returned 1 [0146.509] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0146.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg", lpFilePart=0x0) returned 0x36 [0146.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0146.510] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg.rogue", nBufferLength=0x3d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg.rogue", lpFilePart=0x0) returned 0x3c [0146.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0146.510] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\ycxqixz9t8neodl.jpg"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4299360, ftCreationTime.dwHighDateTime=0x1d5e485, ftLastAccessTime.dwLowDateTime=0x2df85ea0, ftLastAccessTime.dwHighDateTime=0x1d5ef7d, ftLastWriteTime.dwLowDateTime=0x600f3ea0, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14c90)) returned 1 [0146.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0146.510] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\ycxqixz9t8neodl.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\hrP4khIfl\\YCXQixz9T8neoDl.jpg.rogue" (normalized: "c:\\users\\fd1hvy\\pictures\\hrp4khifl\\ycxqixz9t8neodl.jpg.rogue")) returned 1 [0146.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0146.511] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0146.511] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f728 [0146.512] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.513] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.513] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.513] FindClose (in: hFindFile=0x7a5f728 | out: hFindFile=0x7a5f728) returned 1 [0146.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0146.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x27 [0146.513] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0146.514] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.514] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.514] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0146.514] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0146.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0146.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x16 [0146.514] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x16, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0146.514] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8a3887a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8a3887a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f868 [0146.515] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8a3887a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8a3887a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.515] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-WkayQiLEGSVT-q3", cAlternateFileName="-WKAYQ~1")) returned 1 [0146.520] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd3ad480, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x48499410, ftLastAccessTime.dwHighDateTime=0x1d5ee9f, ftLastWriteTime.dwLowDateTime=0x48499410, ftLastWriteTime.dwHighDateTime=0x1d5ee9f, nFileSizeHigh=0x0, nFileSizeLow=0x3d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="7tQs5tmiMqEhxy.m4a", cAlternateFileName="7TQS5T~1.M4A")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYziyn", cAlternateFileName="")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce39c10, ftCreationTime.dwHighDateTime=0x1d5ec0e, ftLastAccessTime.dwLowDateTime=0x99de82c0, ftLastAccessTime.dwHighDateTime=0x1d5e84d, ftLastWriteTime.dwLowDateTime=0x99de82c0, ftLastWriteTime.dwHighDateTime=0x1d5e84d, nFileSizeHigh=0x0, nFileSizeLow=0x9632, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZi-9Daq.wav", cAlternateFileName="")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KZSloTJz", cAlternateFileName="")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca494e0, ftCreationTime.dwHighDateTime=0x1d5eaf0, ftLastAccessTime.dwLowDateTime=0x30a7da00, ftLastAccessTime.dwHighDateTime=0x1d5e9a5, ftLastWriteTime.dwLowDateTime=0x30a7da00, ftLastWriteTime.dwHighDateTime=0x1d5e9a5, nFileSizeHigh=0x0, nFileSizeLow=0xaf85, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0wkBlL9X8.wav", cAlternateFileName="M0WKBL~1.WAV")) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd455ced0, ftCreationTime.dwHighDateTime=0x1d5e380, ftLastAccessTime.dwLowDateTime=0x94a3f80, ftLastAccessTime.dwHighDateTime=0x1d5e792, ftLastWriteTime.dwLowDateTime=0x94a3f80, ftLastWriteTime.dwHighDateTime=0x1d5e792, nFileSizeHigh=0x0, nFileSizeLow=0x16a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZAtTv4PBAV.m4a", cAlternateFileName="ZATTV4~1.M4A")) returned 1 [0146.522] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.522] FindClose (in: hFindFile=0x7a5f868 | out: hFindFile=0x7a5f868) returned 1 [0146.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0146.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0146.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0146.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x16 [0146.522] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music", nBufferLength=0x16, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music", lpFilePart=0x0) returned 0x15 [0146.522] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8a3887a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8a3887a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0146.523] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8a3887a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8a3887a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-WkayQiLEGSVT-q3", cAlternateFileName="-WKAYQ~1")) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd3ad480, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x48499410, ftLastAccessTime.dwHighDateTime=0x1d5ee9f, ftLastWriteTime.dwLowDateTime=0x48499410, ftLastWriteTime.dwHighDateTime=0x1d5ee9f, nFileSizeHigh=0x0, nFileSizeLow=0x3d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="7tQs5tmiMqEhxy.m4a", cAlternateFileName="7TQS5T~1.M4A")) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aYziyn", cAlternateFileName="")) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce39c10, ftCreationTime.dwHighDateTime=0x1d5ec0e, ftLastAccessTime.dwLowDateTime=0x99de82c0, ftLastAccessTime.dwHighDateTime=0x1d5e84d, ftLastWriteTime.dwLowDateTime=0x99de82c0, ftLastWriteTime.dwHighDateTime=0x1d5e84d, nFileSizeHigh=0x0, nFileSizeLow=0x9632, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZi-9Daq.wav", cAlternateFileName="")) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KZSloTJz", cAlternateFileName="")) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca494e0, ftCreationTime.dwHighDateTime=0x1d5eaf0, ftLastAccessTime.dwLowDateTime=0x30a7da00, ftLastAccessTime.dwHighDateTime=0x1d5e9a5, ftLastWriteTime.dwLowDateTime=0x30a7da00, ftLastWriteTime.dwHighDateTime=0x1d5e9a5, nFileSizeHigh=0x0, nFileSizeLow=0xaf85, dwReserved0=0x0, dwReserved1=0x0, cFileName="m0wkBlL9X8.wav", cAlternateFileName="M0WKBL~1.WAV")) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd455ced0, ftCreationTime.dwHighDateTime=0x1d5e380, ftLastAccessTime.dwLowDateTime=0x94a3f80, ftLastAccessTime.dwHighDateTime=0x1d5e792, ftLastWriteTime.dwLowDateTime=0x94a3f80, ftLastWriteTime.dwHighDateTime=0x1d5e792, nFileSizeHigh=0x0, nFileSizeLow=0x16a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZAtTv4PBAV.m4a", cAlternateFileName="ZATTV4~1.M4A")) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd455ced0, ftCreationTime.dwHighDateTime=0x1d5e380, ftLastAccessTime.dwLowDateTime=0x94a3f80, ftLastAccessTime.dwHighDateTime=0x1d5e792, ftLastWriteTime.dwLowDateTime=0x94a3f80, ftLastWriteTime.dwHighDateTime=0x1d5e792, nFileSizeHigh=0x0, nFileSizeLow=0x16a9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZAtTv4PBAV.m4a", cAlternateFileName="ZATTV4~1.M4A")) returned 0 [0146.525] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0146.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0146.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0146.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0146.525] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", lpFilePart=0x0) returned 0x26 [0146.525] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f728 [0146.526] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b88c9d0, ftCreationTime.dwHighDateTime=0x1d5e27a, ftLastAccessTime.dwLowDateTime=0xaaf4310, ftLastAccessTime.dwHighDateTime=0x1d5edfb, ftLastWriteTime.dwLowDateTime=0xaaf4310, ftLastWriteTime.dwHighDateTime=0x1d5edfb, nFileSizeHigh=0x0, nFileSizeLow=0x15bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOintJi1HL_zV.mp3", cAlternateFileName="BOINTJ~1.MP3")) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0d8170, ftCreationTime.dwHighDateTime=0x1d5efb0, ftLastAccessTime.dwLowDateTime=0xd704c6c0, ftLastAccessTime.dwHighDateTime=0x1d5eff8, ftLastWriteTime.dwLowDateTime=0xd704c6c0, ftLastWriteTime.dwHighDateTime=0x1d5eff8, nFileSizeHigh=0x0, nFileSizeLow=0x11dd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKdAmBc77gMazT-.wav", cAlternateFileName="SKDAMB~1.WAV")) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.526] FindClose (in: hFindFile=0x7a5f728 | out: hFindFile=0x7a5f728) returned 1 [0146.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0146.527] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3", lpFilePart=0x0) returned 0x26 [0146.527] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5faa8 [0146.527] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cb583e0, ftCreationTime.dwHighDateTime=0x1d5e751, ftLastAccessTime.dwLowDateTime=0x4a79a180, ftLastAccessTime.dwHighDateTime=0x1d5e37d, ftLastWriteTime.dwLowDateTime=0x4a79a180, ftLastWriteTime.dwHighDateTime=0x1d5e37d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.527] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b88c9d0, ftCreationTime.dwHighDateTime=0x1d5e27a, ftLastAccessTime.dwLowDateTime=0xaaf4310, ftLastAccessTime.dwHighDateTime=0x1d5edfb, ftLastWriteTime.dwLowDateTime=0xaaf4310, ftLastWriteTime.dwHighDateTime=0x1d5edfb, nFileSizeHigh=0x0, nFileSizeLow=0x15bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="bOintJi1HL_zV.mp3", cAlternateFileName="BOINTJ~1.MP3")) returned 1 [0146.528] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0d8170, ftCreationTime.dwHighDateTime=0x1d5efb0, ftLastAccessTime.dwLowDateTime=0xd704c6c0, ftLastAccessTime.dwHighDateTime=0x1d5eff8, ftLastWriteTime.dwLowDateTime=0xd704c6c0, ftLastWriteTime.dwHighDateTime=0x1d5eff8, nFileSizeHigh=0x0, nFileSizeLow=0x11dd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKdAmBc77gMazT-.wav", cAlternateFileName="SKDAMB~1.WAV")) returned 1 [0146.528] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0d8170, ftCreationTime.dwHighDateTime=0x1d5efb0, ftLastAccessTime.dwLowDateTime=0xd704c6c0, ftLastAccessTime.dwHighDateTime=0x1d5eff8, ftLastWriteTime.dwLowDateTime=0xd704c6c0, ftLastWriteTime.dwHighDateTime=0x1d5eff8, nFileSizeHigh=0x0, nFileSizeLow=0x11dd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKdAmBc77gMazT-.wav", cAlternateFileName="SKDAMB~1.WAV")) returned 0 [0146.528] FindClose (in: hFindFile=0x7a5faa8 | out: hFindFile=0x7a5faa8) returned 1 [0146.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0146.528] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", lpFilePart=0x0) returned 0x38 [0146.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0146.529] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-wkayqilegsvt-q3\\bointji1hl_zv.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.529] GetFileType (hFile=0x2cc) returned 0x1 [0146.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0146.529] GetFileType (hFile=0x2cc) returned 0x1 [0146.529] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x15bea [0146.530] ReadFile (in: hFile=0x2cc, lpBuffer=0x397c910, nNumberOfBytesToRead=0x15bea, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x397c910*, lpNumberOfBytesRead=0x8febe8*=0x15bea, lpOverlapped=0x0) returned 1 [0146.531] CloseHandle (hObject=0x2cc) returned 1 [0146.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0146.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0146.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0146.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0146.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0146.617] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", lpFilePart=0x0) returned 0x38 [0146.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0146.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-wkayqilegsvt-q3\\bointji1hl_zv.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.619] GetFileType (hFile=0x2cc) returned 0x1 [0146.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0146.619] GetFileType (hFile=0x2cc) returned 0x1 [0146.619] WriteFile (in: hFile=0x2cc, lpBuffer=0x39e94f8*, nNumberOfBytesToWrite=0x15bf0, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x39e94f8*, lpNumberOfBytesWritten=0x8febdc*=0x15bf0, lpOverlapped=0x0) returned 1 [0146.621] CloseHandle (hObject=0x2cc) returned 1 [0146.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0146.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", nBufferLength=0x39, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3", lpFilePart=0x0) returned 0x38 [0146.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0146.628] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3.rogue", nBufferLength=0x3f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3.rogue", lpFilePart=0x0) returned 0x3e [0146.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0146.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-wkayqilegsvt-q3\\bointji1hl_zv.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b88c9d0, ftCreationTime.dwHighDateTime=0x1d5e27a, ftLastAccessTime.dwLowDateTime=0xaaf4310, ftLastAccessTime.dwHighDateTime=0x1d5edfb, ftLastWriteTime.dwLowDateTime=0x6022523f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x15bf0)) returned 1 [0146.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0146.629] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3" (normalized: "c:\\users\\fd1hvy\\music\\-wkayqilegsvt-q3\\bointji1hl_zv.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\-WkayQiLEGSVT-q3\\bOintJi1HL_zV.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\music\\-wkayqilegsvt-q3\\bointji1hl_zv.mp3.rogue")) returned 1 [0146.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0146.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn", nBufferLength=0x1d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn", lpFilePart=0x0) returned 0x1c [0146.630] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f868 [0146.630] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.630] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NIFAIQvfAOcrgU2u5cC", cAlternateFileName="8NIFAI~1")) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49c8320, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0x5deb1780, ftLastAccessTime.dwHighDateTime=0x1d5ee9a, ftLastWriteTime.dwLowDateTime=0x5deb1780, ftLastWriteTime.dwHighDateTime=0x1d5ee9a, nFileSizeHigh=0x0, nFileSizeLow=0x9855, dwReserved0=0x0, dwReserved1=0x0, cFileName="F2sHJ.m4a", cAlternateFileName="")) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lKjb3JOF-xTn", cAlternateFileName="LKJB3J~1")) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8e4d80, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x600e97d0, ftLastAccessTime.dwHighDateTime=0x1d5f01b, ftLastWriteTime.dwLowDateTime=0x600e97d0, ftLastWriteTime.dwHighDateTime=0x1d5f01b, nFileSizeHigh=0x0, nFileSizeLow=0x179b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="q1Sr3i1Bmz.m4a", cAlternateFileName="Q1SR3I~1.M4A")) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uwjStOgHt", cAlternateFileName="UWJSTO~1")) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uwjStOgHt", cAlternateFileName="UWJSTO~1")) returned 0 [0146.631] FindClose (in: hFindFile=0x7a5f868 | out: hFindFile=0x7a5f868) returned 1 [0146.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0146.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0146.632] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn", nBufferLength=0x1d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn", lpFilePart=0x0) returned 0x1c [0146.632] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fc68 [0146.632] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b0cb420, ftCreationTime.dwHighDateTime=0x1d5e409, ftLastAccessTime.dwLowDateTime=0x5f13b850, ftLastAccessTime.dwHighDateTime=0x1d5e10d, ftLastWriteTime.dwLowDateTime=0x5f13b850, ftLastWriteTime.dwHighDateTime=0x1d5e10d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.632] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8NIFAIQvfAOcrgU2u5cC", cAlternateFileName="8NIFAI~1")) returned 1 [0146.632] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49c8320, ftCreationTime.dwHighDateTime=0x1d5e79d, ftLastAccessTime.dwLowDateTime=0x5deb1780, ftLastAccessTime.dwHighDateTime=0x1d5ee9a, ftLastWriteTime.dwLowDateTime=0x5deb1780, ftLastWriteTime.dwHighDateTime=0x1d5ee9a, nFileSizeHigh=0x0, nFileSizeLow=0x9855, dwReserved0=0x0, dwReserved1=0x0, cFileName="F2sHJ.m4a", cAlternateFileName="")) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lKjb3JOF-xTn", cAlternateFileName="LKJB3J~1")) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc8e4d80, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x600e97d0, ftLastAccessTime.dwHighDateTime=0x1d5f01b, ftLastWriteTime.dwLowDateTime=0x600e97d0, ftLastWriteTime.dwHighDateTime=0x1d5f01b, nFileSizeHigh=0x0, nFileSizeLow=0x179b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="q1Sr3i1Bmz.m4a", cAlternateFileName="Q1SR3I~1.M4A")) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uwjStOgHt", cAlternateFileName="UWJSTO~1")) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.633] FindClose (in: hFindFile=0x7a5fc68 | out: hFindFile=0x7a5fc68) returned 1 [0146.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0146.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0146.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0146.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", lpFilePart=0x0) returned 0x31 [0146.634] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0146.634] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.634] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf6bda50, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x3282e190, ftLastAccessTime.dwHighDateTime=0x1d5e481, ftLastWriteTime.dwLowDateTime=0x3282e190, ftLastWriteTime.dwHighDateTime=0x1d5e481, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6dprb.mp3", cAlternateFileName="")) returned 1 [0146.634] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de7acb0, ftCreationTime.dwHighDateTime=0x1d5ecac, ftLastAccessTime.dwLowDateTime=0xa762cf70, ftLastAccessTime.dwHighDateTime=0x1d5e305, ftLastWriteTime.dwLowDateTime=0xa762cf70, ftLastWriteTime.dwHighDateTime=0x1d5e305, nFileSizeHigh=0x0, nFileSizeLow=0x146df, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Wsj6nqNz.mp3", cAlternateFileName="6WSJ6N~1.MP3")) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d55520, ftCreationTime.dwHighDateTime=0x1d5e1c3, ftLastAccessTime.dwLowDateTime=0x34b9910, ftLastAccessTime.dwHighDateTime=0x1d5e6db, ftLastWriteTime.dwLowDateTime=0x34b9910, ftLastWriteTime.dwHighDateTime=0x1d5e6db, nFileSizeHigh=0x0, nFileSizeLow=0x18612, dwReserved0=0x0, dwReserved1=0x0, cFileName="e5cNX2.m4a", cAlternateFileName="")) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2a02c0, ftCreationTime.dwHighDateTime=0x1d5eaa0, ftLastAccessTime.dwLowDateTime=0x1e4af530, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x1e4af530, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x149d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="fcUl3k UepfE68 Mn3cC.wav", cAlternateFileName="FCUL3K~1.WAV")) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6640020, ftCreationTime.dwHighDateTime=0x1d5e9c1, ftLastAccessTime.dwLowDateTime=0xecf93b00, ftLastAccessTime.dwHighDateTime=0x1d5ee18, ftLastWriteTime.dwLowDateTime=0xecf93b00, ftLastWriteTime.dwHighDateTime=0x1d5ee18, nFileSizeHigh=0x0, nFileSizeLow=0x30ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="mD5-Uz.m4a", cAlternateFileName="")) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.635] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0146.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0146.635] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC", lpFilePart=0x0) returned 0x31 [0146.636] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa28 [0146.636] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74112d30, ftCreationTime.dwHighDateTime=0x1d5ed35, ftLastAccessTime.dwLowDateTime=0xb290db00, ftLastAccessTime.dwHighDateTime=0x1d5e55b, ftLastWriteTime.dwLowDateTime=0xb290db00, ftLastWriteTime.dwHighDateTime=0x1d5e55b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf6bda50, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x3282e190, ftLastAccessTime.dwHighDateTime=0x1d5e481, ftLastWriteTime.dwLowDateTime=0x3282e190, ftLastWriteTime.dwHighDateTime=0x1d5e481, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6dprb.mp3", cAlternateFileName="")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de7acb0, ftCreationTime.dwHighDateTime=0x1d5ecac, ftLastAccessTime.dwLowDateTime=0xa762cf70, ftLastAccessTime.dwHighDateTime=0x1d5e305, ftLastWriteTime.dwLowDateTime=0xa762cf70, ftLastWriteTime.dwHighDateTime=0x1d5e305, nFileSizeHigh=0x0, nFileSizeLow=0x146df, dwReserved0=0x0, dwReserved1=0x0, cFileName="6Wsj6nqNz.mp3", cAlternateFileName="6WSJ6N~1.MP3")) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1d55520, ftCreationTime.dwHighDateTime=0x1d5e1c3, ftLastAccessTime.dwLowDateTime=0x34b9910, ftLastAccessTime.dwHighDateTime=0x1d5e6db, ftLastWriteTime.dwLowDateTime=0x34b9910, ftLastWriteTime.dwHighDateTime=0x1d5e6db, nFileSizeHigh=0x0, nFileSizeLow=0x18612, dwReserved0=0x0, dwReserved1=0x0, cFileName="e5cNX2.m4a", cAlternateFileName="")) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba2a02c0, ftCreationTime.dwHighDateTime=0x1d5eaa0, ftLastAccessTime.dwLowDateTime=0x1e4af530, ftLastAccessTime.dwHighDateTime=0x1d5e5c3, ftLastWriteTime.dwLowDateTime=0x1e4af530, ftLastWriteTime.dwHighDateTime=0x1d5e5c3, nFileSizeHigh=0x0, nFileSizeLow=0x149d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="fcUl3k UepfE68 Mn3cC.wav", cAlternateFileName="FCUL3K~1.WAV")) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6640020, ftCreationTime.dwHighDateTime=0x1d5e9c1, ftLastAccessTime.dwLowDateTime=0xecf93b00, ftLastAccessTime.dwHighDateTime=0x1d5ee18, ftLastWriteTime.dwLowDateTime=0xecf93b00, ftLastWriteTime.dwHighDateTime=0x1d5ee18, nFileSizeHigh=0x0, nFileSizeLow=0x30ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="mD5-Uz.m4a", cAlternateFileName="")) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x7a5fa28, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6640020, ftCreationTime.dwHighDateTime=0x1d5e9c1, ftLastAccessTime.dwLowDateTime=0xecf93b00, ftLastAccessTime.dwHighDateTime=0x1d5ee18, ftLastWriteTime.dwLowDateTime=0xecf93b00, ftLastWriteTime.dwHighDateTime=0x1d5ee18, nFileSizeHigh=0x0, nFileSizeLow=0x30ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="mD5-Uz.m4a", cAlternateFileName="")) returned 0 [0146.637] FindClose (in: hFindFile=0x7a5fa28 | out: hFindFile=0x7a5fa28) returned 1 [0146.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0146.637] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", lpFilePart=0x0) returned 0x3b [0146.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0146.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6dprb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.638] GetFileType (hFile=0x2cc) returned 0x1 [0146.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0146.638] GetFileType (hFile=0x2cc) returned 0x1 [0146.638] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0xa9e2 [0146.638] ReadFile (in: hFile=0x2cc, lpBuffer=0x28de78c, nNumberOfBytesToRead=0xa9e2, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28de78c*, lpNumberOfBytesRead=0x8feb70*=0xa9e2, lpOverlapped=0x0) returned 1 [0146.638] CloseHandle (hObject=0x2cc) returned 1 [0146.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0146.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0146.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0146.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0146.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0146.656] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", lpFilePart=0x0) returned 0x3b [0146.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0146.656] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6dprb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.658] GetFileType (hFile=0x2cc) returned 0x1 [0146.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0146.658] GetFileType (hFile=0x2cc) returned 0x1 [0146.658] WriteFile (in: hFile=0x2cc, lpBuffer=0x294b35c*, nNumberOfBytesToWrite=0xa9f0, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x294b35c*, lpNumberOfBytesWritten=0x8feb64*=0xa9f0, lpOverlapped=0x0) returned 1 [0146.724] CloseHandle (hObject=0x2cc) returned 1 [0146.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0146.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", nBufferLength=0x3c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3", lpFilePart=0x0) returned 0x3b [0146.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0146.729] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3.rogue", nBufferLength=0x42, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3.rogue", lpFilePart=0x0) returned 0x41 [0146.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0146.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6dprb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf6bda50, ftCreationTime.dwHighDateTime=0x1d5e6a0, ftLastAccessTime.dwLowDateTime=0x3282e190, ftLastAccessTime.dwHighDateTime=0x1d5e481, ftLastWriteTime.dwLowDateTime=0x60318252, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa9f0)) returned 1 [0146.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0146.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6dprb.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6dprb.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6dprb.mp3.rogue")) returned 1 [0146.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0146.731] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", lpFilePart=0x0) returned 0x3f [0146.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0146.731] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6wsj6nqnz.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.732] GetFileType (hFile=0x2cc) returned 0x1 [0146.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0146.732] GetFileType (hFile=0x2cc) returned 0x1 [0146.732] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0x146df [0146.732] ReadFile (in: hFile=0x2cc, lpBuffer=0x2955fc0, nNumberOfBytesToRead=0x146df, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2955fc0*, lpNumberOfBytesRead=0x8feb70*=0x146df, lpOverlapped=0x0) returned 1 [0146.734] CloseHandle (hObject=0x2cc) returned 1 [0146.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0146.829] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0146.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0146.829] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0146.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0146.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0146.830] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", lpFilePart=0x0) returned 0x3f [0146.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0146.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6wsj6nqnz.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.833] GetFileType (hFile=0x2cc) returned 0x1 [0146.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0146.833] GetFileType (hFile=0x2cc) returned 0x1 [0146.833] WriteFile (in: hFile=0x2cc, lpBuffer=0x29e0260*, nNumberOfBytesToWrite=0x146e0, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x29e0260*, lpNumberOfBytesWritten=0x8feb64*=0x146e0, lpOverlapped=0x0) returned 1 [0146.837] CloseHandle (hObject=0x2cc) returned 1 [0146.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0146.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", nBufferLength=0x40, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3", lpFilePart=0x0) returned 0x3f [0146.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0146.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3.rogue", nBufferLength=0x46, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3.rogue", lpFilePart=0x0) returned 0x45 [0146.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0146.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6wsj6nqnz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de7acb0, ftCreationTime.dwHighDateTime=0x1d5ecac, ftLastAccessTime.dwLowDateTime=0xa762cf70, ftLastAccessTime.dwHighDateTime=0x1d5e305, ftLastWriteTime.dwLowDateTime=0x60416a96, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x146e0)) returned 1 [0146.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0146.846] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6wsj6nqnz.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\8NIFAIQvfAOcrgU2u5cC\\6Wsj6nqNz.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\8nifaiqvfaocrgu2u5cc\\6wsj6nqnz.mp3.rogue")) returned 1 [0146.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0146.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", lpFilePart=0x0) returned 0x29 [0146.848] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fbe8 [0146.848] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.848] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72955e00, ftCreationTime.dwHighDateTime=0x1d5e8d4, ftLastAccessTime.dwLowDateTime=0xe150540, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0xe150540, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xe023, dwReserved0=0x0, dwReserved1=0x0, cFileName="5XbFLx9aqAyCK_.wav", cAlternateFileName="5XBFLX~1.WAV")) returned 1 [0146.848] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf51cecd0, ftCreationTime.dwHighDateTime=0x1d5efaa, ftLastAccessTime.dwLowDateTime=0xed2dc580, ftLastAccessTime.dwHighDateTime=0x1d5effa, ftLastWriteTime.dwLowDateTime=0xed2dc580, ftLastWriteTime.dwHighDateTime=0x1d5effa, nFileSizeHigh=0x0, nFileSizeLow=0x57fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ca14dLN.m4a", cAlternateFileName="")) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c99ca20, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x48874810, ftLastAccessTime.dwHighDateTime=0x1d5f10a, ftLastWriteTime.dwLowDateTime=0x48874810, ftLastWriteTime.dwHighDateTime=0x1d5f10a, nFileSizeHigh=0x0, nFileSizeLow=0xa17, dwReserved0=0x0, dwReserved1=0x0, cFileName="f9_8TGAO.m4a", cAlternateFileName="")) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8919f720, ftCreationTime.dwHighDateTime=0x1d5e27c, ftLastAccessTime.dwLowDateTime=0xc69df170, ftLastAccessTime.dwHighDateTime=0x1d5e0e5, ftLastWriteTime.dwLowDateTime=0xc69df170, ftLastWriteTime.dwHighDateTime=0x1d5e0e5, nFileSizeHigh=0x0, nFileSizeLow=0x13bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhJGCsMVeX.wav", cAlternateFileName="FHJGCS~1.WAV")) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c316520, ftCreationTime.dwHighDateTime=0x1d5f0da, ftLastAccessTime.dwLowDateTime=0xa0fb5220, ftLastAccessTime.dwHighDateTime=0x1d5e8fe, ftLastWriteTime.dwLowDateTime=0xa0fb5220, ftLastWriteTime.dwHighDateTime=0x1d5e8fe, nFileSizeHigh=0x0, nFileSizeLow=0xa11b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HNc6iLo b0VSRHDCAm0.m4a", cAlternateFileName="HNC6IL~1.M4A")) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81276cf0, ftCreationTime.dwHighDateTime=0x1d5ee1b, ftLastAccessTime.dwLowDateTime=0xb3196630, ftLastAccessTime.dwHighDateTime=0x1d5e4fe, ftLastWriteTime.dwLowDateTime=0xb3196630, ftLastWriteTime.dwHighDateTime=0x1d5e4fe, nFileSizeHigh=0x0, nFileSizeLow=0x108a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROhZUutw-7XAqir8.m4a", cAlternateFileName="ROHZUU~1.M4A")) returned 1 [0146.849] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8435c00, ftCreationTime.dwHighDateTime=0x1d5e29e, ftLastAccessTime.dwLowDateTime=0x7e134de0, ftLastAccessTime.dwHighDateTime=0x1d5e772, ftLastWriteTime.dwLowDateTime=0x7e134de0, ftLastWriteTime.dwHighDateTime=0x1d5e772, nFileSizeHigh=0x0, nFileSizeLow=0x10148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wv9DRqXxeD-Ey9.m4a", cAlternateFileName="WV9DRQ~1.M4A")) returned 1 [0146.850] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794912a0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x2e7d3e70, ftLastAccessTime.dwHighDateTime=0x1d5e8cc, ftLastWriteTime.dwLowDateTime=0x2e7d3e70, ftLastWriteTime.dwHighDateTime=0x1d5e8cc, nFileSizeHigh=0x0, nFileSizeLow=0x147b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3ZkGg4wqqS_9OcVERA3.wav", cAlternateFileName="Z3ZKGG~1.WAV")) returned 1 [0146.850] FindNextFileW (in: hFindFile=0x7a5fbe8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.850] FindClose (in: hFindFile=0x7a5fbe8 | out: hFindFile=0x7a5fbe8) returned 1 [0146.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0146.850] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn", lpFilePart=0x0) returned 0x29 [0146.851] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\lKjb3JOF-xTn\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9e8 [0146.851] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e6bff0, ftCreationTime.dwHighDateTime=0x1d5e69d, ftLastAccessTime.dwLowDateTime=0x79fa88c0, ftLastAccessTime.dwHighDateTime=0x1d5e9cc, ftLastWriteTime.dwLowDateTime=0x79fa88c0, ftLastWriteTime.dwHighDateTime=0x1d5e9cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.851] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72955e00, ftCreationTime.dwHighDateTime=0x1d5e8d4, ftLastAccessTime.dwLowDateTime=0xe150540, ftLastAccessTime.dwHighDateTime=0x1d5f11a, ftLastWriteTime.dwLowDateTime=0xe150540, ftLastWriteTime.dwHighDateTime=0x1d5f11a, nFileSizeHigh=0x0, nFileSizeLow=0xe023, dwReserved0=0x0, dwReserved1=0x0, cFileName="5XbFLx9aqAyCK_.wav", cAlternateFileName="5XBFLX~1.WAV")) returned 1 [0146.851] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf51cecd0, ftCreationTime.dwHighDateTime=0x1d5efaa, ftLastAccessTime.dwLowDateTime=0xed2dc580, ftLastAccessTime.dwHighDateTime=0x1d5effa, ftLastWriteTime.dwLowDateTime=0xed2dc580, ftLastWriteTime.dwHighDateTime=0x1d5effa, nFileSizeHigh=0x0, nFileSizeLow=0x57fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ca14dLN.m4a", cAlternateFileName="")) returned 1 [0146.851] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c99ca20, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0x48874810, ftLastAccessTime.dwHighDateTime=0x1d5f10a, ftLastWriteTime.dwLowDateTime=0x48874810, ftLastWriteTime.dwHighDateTime=0x1d5f10a, nFileSizeHigh=0x0, nFileSizeLow=0xa17, dwReserved0=0x0, dwReserved1=0x0, cFileName="f9_8TGAO.m4a", cAlternateFileName="")) returned 1 [0146.852] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8919f720, ftCreationTime.dwHighDateTime=0x1d5e27c, ftLastAccessTime.dwLowDateTime=0xc69df170, ftLastAccessTime.dwHighDateTime=0x1d5e0e5, ftLastWriteTime.dwLowDateTime=0xc69df170, ftLastWriteTime.dwHighDateTime=0x1d5e0e5, nFileSizeHigh=0x0, nFileSizeLow=0x13bea, dwReserved0=0x0, dwReserved1=0x0, cFileName="fhJGCsMVeX.wav", cAlternateFileName="FHJGCS~1.WAV")) returned 1 [0146.852] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c316520, ftCreationTime.dwHighDateTime=0x1d5f0da, ftLastAccessTime.dwLowDateTime=0xa0fb5220, ftLastAccessTime.dwHighDateTime=0x1d5e8fe, ftLastWriteTime.dwLowDateTime=0xa0fb5220, ftLastWriteTime.dwHighDateTime=0x1d5e8fe, nFileSizeHigh=0x0, nFileSizeLow=0xa11b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HNc6iLo b0VSRHDCAm0.m4a", cAlternateFileName="HNC6IL~1.M4A")) returned 1 [0146.852] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81276cf0, ftCreationTime.dwHighDateTime=0x1d5ee1b, ftLastAccessTime.dwLowDateTime=0xb3196630, ftLastAccessTime.dwHighDateTime=0x1d5e4fe, ftLastWriteTime.dwLowDateTime=0xb3196630, ftLastWriteTime.dwHighDateTime=0x1d5e4fe, nFileSizeHigh=0x0, nFileSizeLow=0x108a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROhZUutw-7XAqir8.m4a", cAlternateFileName="ROHZUU~1.M4A")) returned 1 [0146.852] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8435c00, ftCreationTime.dwHighDateTime=0x1d5e29e, ftLastAccessTime.dwLowDateTime=0x7e134de0, ftLastAccessTime.dwHighDateTime=0x1d5e772, ftLastWriteTime.dwLowDateTime=0x7e134de0, ftLastWriteTime.dwHighDateTime=0x1d5e772, nFileSizeHigh=0x0, nFileSizeLow=0x10148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wv9DRqXxeD-Ey9.m4a", cAlternateFileName="WV9DRQ~1.M4A")) returned 1 [0146.853] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794912a0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x2e7d3e70, ftLastAccessTime.dwHighDateTime=0x1d5e8cc, ftLastWriteTime.dwLowDateTime=0x2e7d3e70, ftLastWriteTime.dwHighDateTime=0x1d5e8cc, nFileSizeHigh=0x0, nFileSizeLow=0x147b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3ZkGg4wqqS_9OcVERA3.wav", cAlternateFileName="Z3ZKGG~1.WAV")) returned 1 [0146.853] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794912a0, ftCreationTime.dwHighDateTime=0x1d5ecb7, ftLastAccessTime.dwLowDateTime=0x2e7d3e70, ftLastAccessTime.dwHighDateTime=0x1d5e8cc, ftLastWriteTime.dwLowDateTime=0x2e7d3e70, ftLastWriteTime.dwHighDateTime=0x1d5e8cc, nFileSizeHigh=0x0, nFileSizeLow=0x147b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3ZkGg4wqqS_9OcVERA3.wav", cAlternateFileName="Z3ZKGG~1.WAV")) returned 0 [0146.853] FindClose (in: hFindFile=0x7a5f9e8 | out: hFindFile=0x7a5f9e8) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0146.853] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", lpFilePart=0x0) returned 0x26 [0146.853] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f868 [0146.854] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.854] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc6c8b0, ftCreationTime.dwHighDateTime=0x1d5ea14, ftLastAccessTime.dwLowDateTime=0x37a5e000, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0x37a5e000, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0xb8fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FQYE8uebwaFoQ7N6c.m4a", cAlternateFileName="FQYE8U~1.M4A")) returned 1 [0146.854] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc603b060, ftCreationTime.dwHighDateTime=0x1d5e900, ftLastAccessTime.dwLowDateTime=0x19dc3230, ftLastAccessTime.dwHighDateTime=0x1d5ea1d, ftLastWriteTime.dwLowDateTime=0x19dc3230, ftLastWriteTime.dwHighDateTime=0x1d5ea1d, nFileSizeHigh=0x0, nFileSizeLow=0x14ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="frYevnOYcyU2LYZsl5.mp3", cAlternateFileName="FRYEVN~1.MP3")) returned 1 [0146.854] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac38950, ftCreationTime.dwHighDateTime=0x1d5e99e, ftLastAccessTime.dwLowDateTime=0x90b22900, ftLastAccessTime.dwHighDateTime=0x1d5ee5a, ftLastWriteTime.dwLowDateTime=0x90b22900, ftLastWriteTime.dwHighDateTime=0x1d5ee5a, nFileSizeHigh=0x0, nFileSizeLow=0x8707, dwReserved0=0x0, dwReserved1=0x0, cFileName="g-DLQ_oQ7ufDGpuwYdxl.m4a", cAlternateFileName="G-DLQ_~1.M4A")) returned 1 [0146.855] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177f0c60, ftCreationTime.dwHighDateTime=0x1d5e1da, ftLastAccessTime.dwLowDateTime=0x823143b0, ftLastAccessTime.dwHighDateTime=0x1d5ecda, ftLastWriteTime.dwLowDateTime=0x823143b0, ftLastWriteTime.dwHighDateTime=0x1d5ecda, nFileSizeHigh=0x0, nFileSizeLow=0x5d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="QY0RkaYqVv6j5e.m4a", cAlternateFileName="QY0RKA~1.M4A")) returned 1 [0146.855] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7225ed70, ftCreationTime.dwHighDateTime=0x1d5e89f, ftLastAccessTime.dwLowDateTime=0x309e19b0, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0x309e19b0, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0xdae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvpV_a 8RR8RItFxnCe.m4a", cAlternateFileName="TVPV_A~1.M4A")) returned 1 [0146.855] FindNextFileW (in: hFindFile=0x7a5f868, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.855] FindClose (in: hFindFile=0x7a5f868 | out: hFindFile=0x7a5f868) returned 1 [0146.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0146.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x27 [0146.855] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", nBufferLength=0x27, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt", lpFilePart=0x0) returned 0x26 [0146.856] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9e8 [0146.856] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc9b3290, ftCreationTime.dwHighDateTime=0x1d5e389, ftLastAccessTime.dwLowDateTime=0x22b0df90, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x22b0df90, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.856] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc6c8b0, ftCreationTime.dwHighDateTime=0x1d5ea14, ftLastAccessTime.dwLowDateTime=0x37a5e000, ftLastAccessTime.dwHighDateTime=0x1d5e201, ftLastWriteTime.dwLowDateTime=0x37a5e000, ftLastWriteTime.dwHighDateTime=0x1d5e201, nFileSizeHigh=0x0, nFileSizeLow=0xb8fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FQYE8uebwaFoQ7N6c.m4a", cAlternateFileName="FQYE8U~1.M4A")) returned 1 [0146.856] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc603b060, ftCreationTime.dwHighDateTime=0x1d5e900, ftLastAccessTime.dwLowDateTime=0x19dc3230, ftLastAccessTime.dwHighDateTime=0x1d5ea1d, ftLastWriteTime.dwLowDateTime=0x19dc3230, ftLastWriteTime.dwHighDateTime=0x1d5ea1d, nFileSizeHigh=0x0, nFileSizeLow=0x14ba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="frYevnOYcyU2LYZsl5.mp3", cAlternateFileName="FRYEVN~1.MP3")) returned 1 [0146.857] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac38950, ftCreationTime.dwHighDateTime=0x1d5e99e, ftLastAccessTime.dwLowDateTime=0x90b22900, ftLastAccessTime.dwHighDateTime=0x1d5ee5a, ftLastWriteTime.dwLowDateTime=0x90b22900, ftLastWriteTime.dwHighDateTime=0x1d5ee5a, nFileSizeHigh=0x0, nFileSizeLow=0x8707, dwReserved0=0x0, dwReserved1=0x0, cFileName="g-DLQ_oQ7ufDGpuwYdxl.m4a", cAlternateFileName="G-DLQ_~1.M4A")) returned 1 [0146.857] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x177f0c60, ftCreationTime.dwHighDateTime=0x1d5e1da, ftLastAccessTime.dwLowDateTime=0x823143b0, ftLastAccessTime.dwHighDateTime=0x1d5ecda, ftLastWriteTime.dwLowDateTime=0x823143b0, ftLastWriteTime.dwHighDateTime=0x1d5ecda, nFileSizeHigh=0x0, nFileSizeLow=0x5d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="QY0RkaYqVv6j5e.m4a", cAlternateFileName="QY0RKA~1.M4A")) returned 1 [0146.857] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7225ed70, ftCreationTime.dwHighDateTime=0x1d5e89f, ftLastAccessTime.dwLowDateTime=0x309e19b0, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0x309e19b0, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0xdae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvpV_a 8RR8RItFxnCe.m4a", cAlternateFileName="TVPV_A~1.M4A")) returned 1 [0146.857] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7225ed70, ftCreationTime.dwHighDateTime=0x1d5e89f, ftLastAccessTime.dwLowDateTime=0x309e19b0, ftLastAccessTime.dwHighDateTime=0x1d5e86b, ftLastWriteTime.dwLowDateTime=0x309e19b0, ftLastWriteTime.dwHighDateTime=0x1d5e86b, nFileSizeHigh=0x0, nFileSizeLow=0xdae3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TvpV_a 8RR8RItFxnCe.m4a", cAlternateFileName="TVPV_A~1.M4A")) returned 0 [0146.858] FindClose (in: hFindFile=0x7a5f9e8 | out: hFindFile=0x7a5f9e8) returned 1 [0146.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0146.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0146.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0146.858] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", lpFilePart=0x0) returned 0x3d [0146.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0146.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\uwjstoght\\fryevnoycyu2lyzsl5.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0146.858] GetFileType (hFile=0x2cc) returned 0x1 [0146.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0146.858] GetFileType (hFile=0x2cc) returned 0x1 [0146.858] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0x14ba7 [0146.859] ReadFile (in: hFile=0x2cc, lpBuffer=0x2810a78, nNumberOfBytesToRead=0x14ba7, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x2810a78*, lpNumberOfBytesRead=0x8feb70*=0x14ba7, lpOverlapped=0x0) returned 1 [0146.860] CloseHandle (hObject=0x2cc) returned 1 [0147.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0147.159] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0147.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0147.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0147.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0147.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", lpFilePart=0x0) returned 0x3d [0147.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0147.160] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\uwjstoght\\fryevnoycyu2lyzsl5.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.597] GetFileType (hFile=0x2cc) returned 0x1 [0147.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0147.597] GetFileType (hFile=0x2cc) returned 0x1 [0147.597] WriteFile (in: hFile=0x2cc, lpBuffer=0x289bce4*, nNumberOfBytesToWrite=0x14bb0, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x289bce4*, lpNumberOfBytesWritten=0x8feb64*=0x14bb0, lpOverlapped=0x0) returned 1 [0147.601] CloseHandle (hObject=0x2cc) returned 1 [0147.604] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0147.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3", lpFilePart=0x0) returned 0x3d [0147.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0147.605] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3.rogue", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3.rogue", lpFilePart=0x0) returned 0x43 [0147.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0147.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\uwjstoght\\fryevnoycyu2lyzsl5.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc603b060, ftCreationTime.dwHighDateTime=0x1d5e900, ftLastAccessTime.dwLowDateTime=0x19dc3230, ftLastAccessTime.dwHighDateTime=0x1d5ea1d, ftLastWriteTime.dwLowDateTime=0x60b6645d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x14bb0)) returned 1 [0147.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0147.605] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\uwjstoght\\fryevnoycyu2lyzsl5.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\aYziyn\\uwjStOgHt\\frYevnOYcyU2LYZsl5.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\music\\ayziyn\\uwjstoght\\fryevnoycyu2lyzsl5.mp3.rogue")) returned 1 [0147.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0147.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0147.606] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz", nBufferLength=0x1f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz", lpFilePart=0x0) returned 0x1e [0147.606] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f928 [0147.607] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.607] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 c6yM8F", cAlternateFileName="1C6YM8~1")) returned 1 [0147.607] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKJS9CZfMybP8ON", cAlternateFileName="GKJS9C~1")) returned 1 [0147.608] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKJS9CZfMybP8ON", cAlternateFileName="GKJS9C~1")) returned 0 [0147.608] FindClose (in: hFindFile=0x7a5f928 | out: hFindFile=0x7a5f928) returned 1 [0147.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0147.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0147.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0147.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1f [0147.608] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz", nBufferLength=0x1f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz", lpFilePart=0x0) returned 0x1e [0147.608] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9e8 [0147.609] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59703190, ftCreationTime.dwHighDateTime=0x1d5ec88, ftLastAccessTime.dwLowDateTime=0xd6fb64d0, ftLastAccessTime.dwHighDateTime=0x1d5e61c, ftLastWriteTime.dwLowDateTime=0xd6fb64d0, ftLastWriteTime.dwHighDateTime=0x1d5e61c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.609] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 c6yM8F", cAlternateFileName="1C6YM8~1")) returned 1 [0147.609] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKJS9CZfMybP8ON", cAlternateFileName="GKJS9C~1")) returned 1 [0147.609] FindNextFileW (in: hFindFile=0x7a5f9e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.609] FindClose (in: hFindFile=0x7a5f9e8 | out: hFindFile=0x7a5f9e8) returned 1 [0147.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0147.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0147.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0147.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0147.613] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", lpFilePart=0x0) returned 0x27 [0147.613] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fea8 [0147.614] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.614] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91270f0, ftCreationTime.dwHighDateTime=0x1d5e28c, ftLastAccessTime.dwLowDateTime=0xdd05fe50, ftLastAccessTime.dwHighDateTime=0x1d5e192, ftLastWriteTime.dwLowDateTime=0xdd05fe50, ftLastWriteTime.dwHighDateTime=0x1d5e192, nFileSizeHigh=0x0, nFileSizeLow=0xa22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LU StPfJUoLFUYrga.mp3", cAlternateFileName="3LUSTP~1.MP3")) returned 1 [0147.614] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322f9ae0, ftCreationTime.dwHighDateTime=0x1d5e3a4, ftLastAccessTime.dwLowDateTime=0xe8b975b0, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0xe8b975b0, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x16019, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbTUE.m4a", cAlternateFileName="")) returned 1 [0147.614] FindNextFileW (in: hFindFile=0x7a5fea8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.615] FindClose (in: hFindFile=0x7a5fea8 | out: hFindFile=0x7a5fea8) returned 1 [0147.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0147.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0147.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0147.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x28 [0147.615] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", nBufferLength=0x28, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F", lpFilePart=0x0) returned 0x27 [0147.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fce8 [0147.615] FindNextFileW (in: hFindFile=0x7a5fce8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05ff980, ftCreationTime.dwHighDateTime=0x1d5e9e2, ftLastAccessTime.dwLowDateTime=0x65d09c0, ftLastAccessTime.dwHighDateTime=0x1d5e615, ftLastWriteTime.dwLowDateTime=0x65d09c0, ftLastWriteTime.dwHighDateTime=0x1d5e615, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.616] FindNextFileW (in: hFindFile=0x7a5fce8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91270f0, ftCreationTime.dwHighDateTime=0x1d5e28c, ftLastAccessTime.dwLowDateTime=0xdd05fe50, ftLastAccessTime.dwHighDateTime=0x1d5e192, ftLastWriteTime.dwLowDateTime=0xdd05fe50, ftLastWriteTime.dwHighDateTime=0x1d5e192, nFileSizeHigh=0x0, nFileSizeLow=0xa22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LU StPfJUoLFUYrga.mp3", cAlternateFileName="3LUSTP~1.MP3")) returned 1 [0147.616] FindNextFileW (in: hFindFile=0x7a5fce8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322f9ae0, ftCreationTime.dwHighDateTime=0x1d5e3a4, ftLastAccessTime.dwLowDateTime=0xe8b975b0, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0xe8b975b0, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x16019, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbTUE.m4a", cAlternateFileName="")) returned 1 [0147.616] FindNextFileW (in: hFindFile=0x7a5fce8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x322f9ae0, ftCreationTime.dwHighDateTime=0x1d5e3a4, ftLastAccessTime.dwLowDateTime=0xe8b975b0, ftLastAccessTime.dwHighDateTime=0x1d5e368, ftLastWriteTime.dwLowDateTime=0xe8b975b0, ftLastWriteTime.dwHighDateTime=0x1d5e368, nFileSizeHigh=0x0, nFileSizeLow=0x16019, dwReserved0=0x0, dwReserved1=0x0, cFileName="vbTUE.m4a", cAlternateFileName="")) returned 0 [0147.616] FindClose (in: hFindFile=0x7a5fce8 | out: hFindFile=0x7a5fce8) returned 1 [0147.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0147.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0147.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0147.616] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x3f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", lpFilePart=0x0) returned 0x3e [0147.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0147.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kzslotjz\\1 c6ym8f\\3lu stpfjuolfuyrga.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.617] GetFileType (hFile=0x2cc) returned 0x1 [0147.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0147.617] GetFileType (hFile=0x2cc) returned 0x1 [0147.617] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0xa22a [0147.617] ReadFile (in: hFile=0x2cc, lpBuffer=0x28b2bf0, nNumberOfBytesToRead=0xa22a, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28b2bf0*, lpNumberOfBytesRead=0x8feb70*=0xa22a, lpOverlapped=0x0) returned 1 [0147.618] CloseHandle (hObject=0x2cc) returned 1 [0147.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0147.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0147.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0147.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0147.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0147.741] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x3f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", lpFilePart=0x0) returned 0x3e [0147.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0147.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kzslotjz\\1 c6ym8f\\3lu stpfjuolfuyrga.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.743] GetFileType (hFile=0x2cc) returned 0x1 [0147.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0147.743] GetFileType (hFile=0x2cc) returned 0x1 [0147.743] WriteFile (in: hFile=0x2cc, lpBuffer=0x29324cc*, nNumberOfBytesToWrite=0xa230, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x29324cc*, lpNumberOfBytesWritten=0x8feb64*=0xa230, lpOverlapped=0x0) returned 1 [0147.745] CloseHandle (hObject=0x2cc) returned 1 [0147.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0147.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", nBufferLength=0x3f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3", lpFilePart=0x0) returned 0x3e [0147.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0147.748] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3.rogue", nBufferLength=0x45, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3.rogue", lpFilePart=0x0) returned 0x44 [0147.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0147.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kzslotjz\\1 c6ym8f\\3lu stpfjuolfuyrga.mp3"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91270f0, ftCreationTime.dwHighDateTime=0x1d5e28c, ftLastAccessTime.dwLowDateTime=0xdd05fe50, ftLastAccessTime.dwHighDateTime=0x1d5e192, ftLastWriteTime.dwLowDateTime=0x60cbe0d8, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa230)) returned 1 [0147.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0147.749] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3" (normalized: "c:\\users\\fd1hvy\\music\\kzslotjz\\1 c6ym8f\\3lu stpfjuolfuyrga.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\1 c6yM8F\\3LU StPfJUoLFUYrga.mp3.rogue" (normalized: "c:\\users\\fd1hvy\\music\\kzslotjz\\1 c6ym8f\\3lu stpfjuolfuyrga.mp3.rogue")) returned 1 [0147.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0147.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0147.755] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", lpFilePart=0x0) returned 0x2e [0147.756] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f768 [0147.756] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.756] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6af7a8b0, ftCreationTime.dwHighDateTime=0x1d5f090, ftLastAccessTime.dwLowDateTime=0x31484200, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x31484200, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0x1250d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUj2u9 onTz8TAgn6.m4a", cAlternateFileName="CUJ2U9~1.M4A")) returned 1 [0147.756] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea004f40, ftCreationTime.dwHighDateTime=0x1d5ee79, ftLastAccessTime.dwLowDateTime=0x5461f2a0, ftLastAccessTime.dwHighDateTime=0x1d5ea31, ftLastWriteTime.dwLowDateTime=0x5461f2a0, ftLastWriteTime.dwHighDateTime=0x1d5ea31, nFileSizeHigh=0x0, nFileSizeLow=0x8058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Imfa.wav", cAlternateFileName="")) returned 1 [0147.757] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7244de0, ftCreationTime.dwHighDateTime=0x1d5e1a7, ftLastAccessTime.dwLowDateTime=0x487ae6d0, ftLastAccessTime.dwHighDateTime=0x1d5eeab, ftLastWriteTime.dwLowDateTime=0x487ae6d0, ftLastWriteTime.dwHighDateTime=0x1d5eeab, nFileSizeHigh=0x0, nFileSizeLow=0x13d1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PpHJFRwR8i VbU59c.wav", cAlternateFileName="PPHJFR~1.WAV")) returned 1 [0147.757] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f5740, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0x15417430, ftLastAccessTime.dwHighDateTime=0x1d5e516, ftLastWriteTime.dwLowDateTime=0x15417430, ftLastWriteTime.dwHighDateTime=0x1d5e516, nFileSizeHigh=0x0, nFileSizeLow=0x14953, dwReserved0=0x0, dwReserved1=0x0, cFileName="uspS3ewO3y3X3j7C.wav", cAlternateFileName="USPS3E~1.WAV")) returned 1 [0147.757] FindNextFileW (in: hFindFile=0x7a5f768, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.757] FindClose (in: hFindFile=0x7a5f768 | out: hFindFile=0x7a5f768) returned 1 [0147.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0147.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0147.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0147.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0147.757] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON", lpFilePart=0x0) returned 0x2e [0147.758] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\KZSloTJz\\GKJS9CZfMybP8ON\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa68 [0147.758] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd8e9d70, ftCreationTime.dwHighDateTime=0x1d5e0f6, ftLastAccessTime.dwLowDateTime=0x6921e720, ftLastAccessTime.dwHighDateTime=0x1d5ea15, ftLastWriteTime.dwLowDateTime=0x6921e720, ftLastWriteTime.dwHighDateTime=0x1d5ea15, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.758] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6af7a8b0, ftCreationTime.dwHighDateTime=0x1d5f090, ftLastAccessTime.dwLowDateTime=0x31484200, ftLastAccessTime.dwHighDateTime=0x1d5e2fd, ftLastWriteTime.dwLowDateTime=0x31484200, ftLastWriteTime.dwHighDateTime=0x1d5e2fd, nFileSizeHigh=0x0, nFileSizeLow=0x1250d, dwReserved0=0x0, dwReserved1=0x0, cFileName="cUj2u9 onTz8TAgn6.m4a", cAlternateFileName="CUJ2U9~1.M4A")) returned 1 [0147.758] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea004f40, ftCreationTime.dwHighDateTime=0x1d5ee79, ftLastAccessTime.dwLowDateTime=0x5461f2a0, ftLastAccessTime.dwHighDateTime=0x1d5ea31, ftLastWriteTime.dwLowDateTime=0x5461f2a0, ftLastWriteTime.dwHighDateTime=0x1d5ea31, nFileSizeHigh=0x0, nFileSizeLow=0x8058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Imfa.wav", cAlternateFileName="")) returned 1 [0147.759] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7244de0, ftCreationTime.dwHighDateTime=0x1d5e1a7, ftLastAccessTime.dwLowDateTime=0x487ae6d0, ftLastAccessTime.dwHighDateTime=0x1d5eeab, ftLastWriteTime.dwLowDateTime=0x487ae6d0, ftLastWriteTime.dwHighDateTime=0x1d5eeab, nFileSizeHigh=0x0, nFileSizeLow=0x13d1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PpHJFRwR8i VbU59c.wav", cAlternateFileName="PPHJFR~1.WAV")) returned 1 [0147.759] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f5740, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0x15417430, ftLastAccessTime.dwHighDateTime=0x1d5e516, ftLastWriteTime.dwLowDateTime=0x15417430, ftLastWriteTime.dwHighDateTime=0x1d5e516, nFileSizeHigh=0x0, nFileSizeLow=0x14953, dwReserved0=0x0, dwReserved1=0x0, cFileName="uspS3ewO3y3X3j7C.wav", cAlternateFileName="USPS3E~1.WAV")) returned 1 [0147.759] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f5740, ftCreationTime.dwHighDateTime=0x1d5f04c, ftLastAccessTime.dwLowDateTime=0x15417430, ftLastAccessTime.dwHighDateTime=0x1d5e516, ftLastWriteTime.dwLowDateTime=0x15417430, ftLastWriteTime.dwHighDateTime=0x1d5e516, nFileSizeHigh=0x0, nFileSizeLow=0x14953, dwReserved0=0x0, dwReserved1=0x0, cFileName="uspS3ewO3y3X3j7C.wav", cAlternateFileName="USPS3E~1.WAV")) returned 0 [0147.759] FindClose (in: hFindFile=0x7a5fa68 | out: hFindFile=0x7a5fa68) returned 1 [0147.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0147.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0147.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.759] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0147.760] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0147.760] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0147.766] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.766] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.766] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.766] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0147.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0147.767] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\OneDrive", lpFilePart=0x0) returned 0x18 [0147.767] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0147.767] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.767] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.767] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0147.768] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0147.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0147.768] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x1c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0147.768] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f728 [0147.768] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.769] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.769] FindNextFileW (in: hFindFile=0x7a5f728, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.769] FindClose (in: hFindFile=0x7a5f728 | out: hFindFile=0x7a5f728) returned 1 [0147.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1c [0147.769] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games", nBufferLength=0x1c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Saved Games", lpFilePart=0x0) returned 0x1b [0147.769] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fca8 [0147.770] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.770] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.770] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0147.771] FindClose (in: hFindFile=0x7a5fca8 | out: hFindFile=0x7a5fca8) returned 1 [0147.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0147.771] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0147.771] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0147.771] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.772] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0147.772] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.772] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0147.772] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0147.772] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0147.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0147.773] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites", nBufferLength=0x1a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites", lpFilePart=0x0) returned 0x19 [0147.773] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0147.773] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.773] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0147.774] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.774] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0147.774] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.774] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0147.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0147.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0147.774] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x20, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0147.775] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fde8 [0147.775] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.775] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.775] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.776] FindClose (in: hFindFile=0x7a5fde8 | out: hFindFile=0x7a5fde8) returned 1 [0147.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0147.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0147.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0147.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0147.776] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links", nBufferLength=0x20, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Favorites\\Links", lpFilePart=0x0) returned 0x1f [0147.776] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fe28 [0147.776] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.776] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.777] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0147.777] FindClose (in: hFindFile=0x7a5fe28 | out: hFindFile=0x7a5fe28) returned 1 [0147.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0147.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0147.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0147.777] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0147.777] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fc68 [0147.778] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.778] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.778] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0147.778] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0147.778] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0147.779] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.779] FindClose (in: hFindFile=0x7a5fc68 | out: hFindFile=0x7a5fc68) returned 1 [0147.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0147.779] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Searches", nBufferLength=0x19, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Searches", lpFilePart=0x0) returned 0x18 [0147.779] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa68 [0147.780] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.780] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.780] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0147.780] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0147.780] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0147.781] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x0, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0147.781] FindClose (in: hFindFile=0x7a5fa68 | out: hFindFile=0x7a5fa68) returned 1 [0147.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0147.781] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x17, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0147.781] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8b902d0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8b902d0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fb28 [0147.782] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8b902d0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8b902d0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.782] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amVSwe", cAlternateFileName="")) returned 1 [0147.782] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.782] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52145090, ftCreationTime.dwHighDateTime=0x1d5eefc, ftLastAccessTime.dwLowDateTime=0x10632ec0, ftLastAccessTime.dwHighDateTime=0x1d5e608, ftLastWriteTime.dwLowDateTime=0x10632ec0, ftLastWriteTime.dwHighDateTime=0x1d5e608, nFileSizeHigh=0x0, nFileSizeLow=0x434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fp6Jg_T2pOPuz9zi.mp4", cAlternateFileName="FP6JG_~1.MP4")) returned 1 [0147.782] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyBQb7", cAlternateFileName="")) returned 1 [0147.783] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d96d2d0, ftCreationTime.dwHighDateTime=0x1d5ebd6, ftLastAccessTime.dwLowDateTime=0xcd5d5220, ftLastAccessTime.dwHighDateTime=0x1d5e776, ftLastWriteTime.dwLowDateTime=0xcd5d5220, ftLastWriteTime.dwHighDateTime=0x1d5e776, nFileSizeHigh=0x0, nFileSizeLow=0x7d3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tad9.swf", cAlternateFileName="")) returned 1 [0147.783] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae53740, ftCreationTime.dwHighDateTime=0x1d5ea8b, ftLastAccessTime.dwLowDateTime=0xf7c435b0, ftLastAccessTime.dwHighDateTime=0x1d5e11d, ftLastWriteTime.dwLowDateTime=0xf7c435b0, ftLastWriteTime.dwHighDateTime=0x1d5e11d, nFileSizeHigh=0x0, nFileSizeLow=0x7a7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tCMd7HnbFV.mkv", cAlternateFileName="TCMD7H~1.MKV")) returned 1 [0147.783] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038bc70, ftCreationTime.dwHighDateTime=0x1d5e1c0, ftLastAccessTime.dwLowDateTime=0x5b0719d0, ftLastAccessTime.dwHighDateTime=0x1d5eb0a, ftLastWriteTime.dwLowDateTime=0x5b0719d0, ftLastWriteTime.dwHighDateTime=0x1d5eb0a, nFileSizeHigh=0x0, nFileSizeLow=0x1734, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHU2arF6j5VkP.mp4", cAlternateFileName="UHU2AR~1.MP4")) returned 1 [0147.783] FindNextFileW (in: hFindFile=0x7a5fb28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.783] FindClose (in: hFindFile=0x7a5fb28 | out: hFindFile=0x7a5fb28) returned 1 [0147.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed10) returned 1 [0147.783] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0147.784] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos", nBufferLength=0x17, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos", lpFilePart=0x0) returned 0x16 [0147.784] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x8fea38 | out: lpFindFileData=0x8fea38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8b902d0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8b902d0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0147.784] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8b902d0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8b902d0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.784] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amVSwe", cAlternateFileName="")) returned 1 [0147.784] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.784] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52145090, ftCreationTime.dwHighDateTime=0x1d5eefc, ftLastAccessTime.dwLowDateTime=0x10632ec0, ftLastAccessTime.dwHighDateTime=0x1d5e608, ftLastWriteTime.dwLowDateTime=0x10632ec0, ftLastWriteTime.dwHighDateTime=0x1d5e608, nFileSizeHigh=0x0, nFileSizeLow=0x434c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fp6Jg_T2pOPuz9zi.mp4", cAlternateFileName="FP6JG_~1.MP4")) returned 1 [0147.785] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyBQb7", cAlternateFileName="")) returned 1 [0147.785] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d96d2d0, ftCreationTime.dwHighDateTime=0x1d5ebd6, ftLastAccessTime.dwLowDateTime=0xcd5d5220, ftLastAccessTime.dwHighDateTime=0x1d5e776, ftLastWriteTime.dwLowDateTime=0xcd5d5220, ftLastWriteTime.dwHighDateTime=0x1d5e776, nFileSizeHigh=0x0, nFileSizeLow=0x7d3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tad9.swf", cAlternateFileName="")) returned 1 [0147.785] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae53740, ftCreationTime.dwHighDateTime=0x1d5ea8b, ftLastAccessTime.dwLowDateTime=0xf7c435b0, ftLastAccessTime.dwHighDateTime=0x1d5e11d, ftLastWriteTime.dwLowDateTime=0xf7c435b0, ftLastWriteTime.dwHighDateTime=0x1d5e11d, nFileSizeHigh=0x0, nFileSizeLow=0x7a7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tCMd7HnbFV.mkv", cAlternateFileName="TCMD7H~1.MKV")) returned 1 [0147.785] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038bc70, ftCreationTime.dwHighDateTime=0x1d5e1c0, ftLastAccessTime.dwLowDateTime=0x5b0719d0, ftLastAccessTime.dwHighDateTime=0x1d5eb0a, ftLastWriteTime.dwLowDateTime=0x5b0719d0, ftLastWriteTime.dwHighDateTime=0x1d5eb0a, nFileSizeHigh=0x0, nFileSizeLow=0x1734, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHU2arF6j5VkP.mp4", cAlternateFileName="UHU2AR~1.MP4")) returned 1 [0147.846] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fea44 | out: lpFindFileData=0x8fea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038bc70, ftCreationTime.dwHighDateTime=0x1d5e1c0, ftLastAccessTime.dwLowDateTime=0x5b0719d0, ftLastAccessTime.dwHighDateTime=0x1d5eb0a, ftLastWriteTime.dwLowDateTime=0x5b0719d0, ftLastWriteTime.dwHighDateTime=0x1d5eb0a, nFileSizeHigh=0x0, nFileSizeLow=0x1734, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHU2arF6j5VkP.mp4", cAlternateFileName="UHU2AR~1.MP4")) returned 0 [0147.846] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0147.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feccc) returned 1 [0147.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecd8) returned 1 [0147.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0147.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", lpFilePart=0x0) returned 0x2b [0147.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0147.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fp6jg_t2popuz9zi.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.847] GetFileType (hFile=0x2cc) returned 0x1 [0147.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0147.847] GetFileType (hFile=0x2cc) returned 0x1 [0147.847] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x434c [0147.847] ReadFile (in: hFile=0x2cc, lpBuffer=0x29447a4, nNumberOfBytesToRead=0x434c, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29447a4*, lpNumberOfBytesRead=0x8fec60*=0x434c, lpOverlapped=0x0) returned 1 [0147.847] CloseHandle (hObject=0x2cc) returned 1 [0147.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0147.873] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0147.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0147.873] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0147.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0147.874] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", lpFilePart=0x0) returned 0x2b [0147.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0147.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fp6jg_t2popuz9zi.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.875] GetFileType (hFile=0x2cc) returned 0x1 [0147.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0147.876] GetFileType (hFile=0x2cc) returned 0x1 [0147.876] WriteFile (in: hFile=0x2cc, lpBuffer=0x29a661c*, nNumberOfBytesToWrite=0x4350, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x29a661c*, lpNumberOfBytesWritten=0x8fec54*=0x4350, lpOverlapped=0x0) returned 1 [0147.877] CloseHandle (hObject=0x2cc) returned 1 [0147.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0147.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4", lpFilePart=0x0) returned 0x2b [0147.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0147.939] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4.rogue", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4.rogue", lpFilePart=0x0) returned 0x31 [0147.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0147.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fp6jg_t2popuz9zi.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52145090, ftCreationTime.dwHighDateTime=0x1d5eefc, ftLastAccessTime.dwLowDateTime=0x10632ec0, ftLastAccessTime.dwHighDateTime=0x1d5e608, ftLastWriteTime.dwLowDateTime=0x60e8769c, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x4350)) returned 1 [0147.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0147.939] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fp6jg_t2popuz9zi.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Fp6Jg_T2pOPuz9zi.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\fp6jg_t2popuz9zi.mp4.rogue")) returned 1 [0147.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0147.940] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", lpFilePart=0x0) returned 0x25 [0147.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0147.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tcmd7hnbfv.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0147.940] GetFileType (hFile=0x2cc) returned 0x1 [0147.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0147.941] GetFileType (hFile=0x2cc) returned 0x1 [0147.941] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x7a7d [0147.941] ReadFile (in: hFile=0x2cc, lpBuffer=0x29aabf4, nNumberOfBytesToRead=0x7a7d, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x29aabf4*, lpNumberOfBytesRead=0x8fec60*=0x7a7d, lpOverlapped=0x0) returned 1 [0147.941] CloseHandle (hObject=0x2cc) returned 1 [0147.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0147.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0147.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0147.971] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0147.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0147.971] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", lpFilePart=0x0) returned 0x25 [0147.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0147.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tcmd7hnbfv.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.028] GetFileType (hFile=0x2cc) returned 0x1 [0148.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0148.028] GetFileType (hFile=0x2cc) returned 0x1 [0148.028] WriteFile (in: hFile=0x2cc, lpBuffer=0x282be10*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x282be10*, lpNumberOfBytesWritten=0x8fec54*=0x7a80, lpOverlapped=0x0) returned 1 [0148.030] CloseHandle (hObject=0x2cc) returned 1 [0148.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0148.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", nBufferLength=0x26, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv", lpFilePart=0x0) returned 0x25 [0148.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0148.038] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv.rogue", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv.rogue", lpFilePart=0x0) returned 0x2b [0148.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0148.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tcmd7hnbfv.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae53740, ftCreationTime.dwHighDateTime=0x1d5ea8b, ftLastAccessTime.dwLowDateTime=0xf7c435b0, ftLastAccessTime.dwHighDateTime=0x1d5e11d, ftLastWriteTime.dwLowDateTime=0x60f94aae, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x7a80)) returned 1 [0148.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0148.039] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\tcmd7hnbfv.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\tCMd7HnbFV.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\tcmd7hnbfv.mkv.rogue")) returned 1 [0148.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0148.040] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", lpFilePart=0x0) returned 0x28 [0148.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb8) returned 1 [0148.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\uhu2arf6j5vkp.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.040] GetFileType (hFile=0x2cc) returned 0x1 [0148.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb4) returned 1 [0148.040] GetFileType (hFile=0x2cc) returned 0x1 [0148.040] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fecb4 | out: lpFileSizeHigh=0x8fecb4*=0x0) returned 0x1734 [0148.040] ReadFile (in: hFile=0x2cc, lpBuffer=0x2833aec, nNumberOfBytesToRead=0x1734, lpNumberOfBytesRead=0x8fec60, lpOverlapped=0x0 | out: lpBuffer=0x2833aec*, lpNumberOfBytesRead=0x8fec60*=0x1734, lpOverlapped=0x0) returned 1 [0148.040] CloseHandle (hObject=0x2cc) returned 1 [0148.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0148.267] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0148.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec2c) returned 1 [0148.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feca8 | out: lpFileInformation=0x8feca8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0148.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec28) returned 1 [0148.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0148.268] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", lpFilePart=0x0) returned 0x28 [0148.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba4) returned 1 [0148.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\uhu2arf6j5vkp.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.270] GetFileType (hFile=0x2cc) returned 0x1 [0148.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feba0) returned 1 [0148.270] GetFileType (hFile=0x2cc) returned 0x1 [0148.270] WriteFile (in: hFile=0x2cc, lpBuffer=0x2887e70*, nNumberOfBytesToWrite=0x1740, lpNumberOfBytesWritten=0x8fec54, lpOverlapped=0x0 | out: lpBuffer=0x2887e70*, lpNumberOfBytesWritten=0x8fec54*=0x1740, lpOverlapped=0x0) returned 1 [0148.271] CloseHandle (hObject=0x2cc) returned 1 [0148.276] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x29 [0148.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", nBufferLength=0x29, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4", lpFilePart=0x0) returned 0x28 [0148.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0148.277] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4.rogue", nBufferLength=0x2f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4.rogue", lpFilePart=0x0) returned 0x2e [0148.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec38) returned 1 [0148.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\uhu2arf6j5vkp.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fecb4 | out: lpFileInformation=0x8fecb4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038bc70, ftCreationTime.dwHighDateTime=0x1d5e1c0, ftLastAccessTime.dwLowDateTime=0x5b0719d0, ftLastAccessTime.dwHighDateTime=0x1d5eb0a, ftLastWriteTime.dwLowDateTime=0x611cf37d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1740)) returned 1 [0148.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec34) returned 1 [0148.277] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\uhu2arf6j5vkp.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\UHU2arF6j5VkP.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\uhu2arf6j5vkp.mp4.rogue")) returned 1 [0148.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0148.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0148.278] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe", nBufferLength=0x1e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe", lpFilePart=0x0) returned 0x1d [0148.278] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fa68 [0148.279] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.279] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85f5020, ftCreationTime.dwHighDateTime=0x1d5e35a, ftLastAccessTime.dwLowDateTime=0xa27c66f0, ftLastAccessTime.dwHighDateTime=0x1d5edab, ftLastWriteTime.dwLowDateTime=0xa27c66f0, ftLastWriteTime.dwHighDateTime=0x1d5edab, nFileSizeHigh=0x0, nFileSizeLow=0x1e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fsc3mmfkIGi0bwI.mp4", cAlternateFileName="FSC3MM~1.MP4")) returned 1 [0148.279] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12bc8270, ftCreationTime.dwHighDateTime=0x1d5e1b2, ftLastAccessTime.dwLowDateTime=0x617cfad0, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x617cfad0, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x17a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="gdvJEKFZV.flv", cAlternateFileName="GDVJEK~1.FLV")) returned 1 [0148.279] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb6d420, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0x606c0f20, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0x606c0f20, ftLastWriteTime.dwHighDateTime=0x1d5ee70, nFileSizeHigh=0x0, nFileSizeLow=0x16a2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="oi_QdObi2A7BVNBVb0.avi", cAlternateFileName="OI_QDO~1.AVI")) returned 1 [0148.280] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa433890, ftCreationTime.dwHighDateTime=0x1d5ec17, ftLastAccessTime.dwLowDateTime=0x57c12bd0, ftLastAccessTime.dwHighDateTime=0x1d5e984, ftLastWriteTime.dwLowDateTime=0x57c12bd0, ftLastWriteTime.dwHighDateTime=0x1d5e984, nFileSizeHigh=0x0, nFileSizeLow=0x1114b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QXN2bRnw.mp4", cAlternateFileName="")) returned 1 [0148.280] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457ee1f0, ftCreationTime.dwHighDateTime=0x1d5ee08, ftLastAccessTime.dwLowDateTime=0x41c3d990, ftLastAccessTime.dwHighDateTime=0x1d5e664, ftLastWriteTime.dwLowDateTime=0x41c3d990, ftLastWriteTime.dwHighDateTime=0x1d5e664, nFileSizeHigh=0x0, nFileSizeLow=0x1547f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKnyB.swf", cAlternateFileName="")) returned 1 [0148.280] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6c72de0, ftCreationTime.dwHighDateTime=0x1d5ef70, ftLastAccessTime.dwLowDateTime=0xb67c0fe0, ftLastAccessTime.dwHighDateTime=0x1d5e1e2, ftLastWriteTime.dwLowDateTime=0xb67c0fe0, ftLastWriteTime.dwHighDateTime=0x1d5e1e2, nFileSizeHigh=0x0, nFileSizeLow=0x962f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZIYdyOlf_N9Xa2Jzyk3y.swf", cAlternateFileName="ZIYDYO~1.SWF")) returned 1 [0148.280] FindNextFileW (in: hFindFile=0x7a5fa68, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0148.280] FindClose (in: hFindFile=0x7a5fa68 | out: hFindFile=0x7a5fa68) returned 1 [0148.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0148.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0148.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0148.280] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0148.281] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe", nBufferLength=0x1e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe", lpFilePart=0x0) returned 0x1d [0148.281] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f8e8 [0148.281] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x700c0b50, ftCreationTime.dwHighDateTime=0x1d5e8e5, ftLastAccessTime.dwLowDateTime=0x64b5a1a0, ftLastAccessTime.dwHighDateTime=0x1d5ea3c, ftLastWriteTime.dwLowDateTime=0x64b5a1a0, ftLastWriteTime.dwHighDateTime=0x1d5ea3c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.281] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85f5020, ftCreationTime.dwHighDateTime=0x1d5e35a, ftLastAccessTime.dwLowDateTime=0xa27c66f0, ftLastAccessTime.dwHighDateTime=0x1d5edab, ftLastWriteTime.dwLowDateTime=0xa27c66f0, ftLastWriteTime.dwHighDateTime=0x1d5edab, nFileSizeHigh=0x0, nFileSizeLow=0x1e84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fsc3mmfkIGi0bwI.mp4", cAlternateFileName="FSC3MM~1.MP4")) returned 1 [0148.281] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12bc8270, ftCreationTime.dwHighDateTime=0x1d5e1b2, ftLastAccessTime.dwLowDateTime=0x617cfad0, ftLastAccessTime.dwHighDateTime=0x1d5e94a, ftLastWriteTime.dwLowDateTime=0x617cfad0, ftLastWriteTime.dwHighDateTime=0x1d5e94a, nFileSizeHigh=0x0, nFileSizeLow=0x17a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="gdvJEKFZV.flv", cAlternateFileName="GDVJEK~1.FLV")) returned 1 [0148.282] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb6d420, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0x606c0f20, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0x606c0f20, ftLastWriteTime.dwHighDateTime=0x1d5ee70, nFileSizeHigh=0x0, nFileSizeLow=0x16a2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="oi_QdObi2A7BVNBVb0.avi", cAlternateFileName="OI_QDO~1.AVI")) returned 1 [0148.282] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa433890, ftCreationTime.dwHighDateTime=0x1d5ec17, ftLastAccessTime.dwLowDateTime=0x57c12bd0, ftLastAccessTime.dwHighDateTime=0x1d5e984, ftLastWriteTime.dwLowDateTime=0x57c12bd0, ftLastWriteTime.dwHighDateTime=0x1d5e984, nFileSizeHigh=0x0, nFileSizeLow=0x1114b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QXN2bRnw.mp4", cAlternateFileName="")) returned 1 [0148.282] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457ee1f0, ftCreationTime.dwHighDateTime=0x1d5ee08, ftLastAccessTime.dwLowDateTime=0x41c3d990, ftLastAccessTime.dwHighDateTime=0x1d5e664, ftLastWriteTime.dwLowDateTime=0x41c3d990, ftLastWriteTime.dwHighDateTime=0x1d5e664, nFileSizeHigh=0x0, nFileSizeLow=0x1547f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vKnyB.swf", cAlternateFileName="")) returned 1 [0148.282] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6c72de0, ftCreationTime.dwHighDateTime=0x1d5ef70, ftLastAccessTime.dwLowDateTime=0xb67c0fe0, ftLastAccessTime.dwHighDateTime=0x1d5e1e2, ftLastWriteTime.dwLowDateTime=0xb67c0fe0, ftLastWriteTime.dwHighDateTime=0x1d5e1e2, nFileSizeHigh=0x0, nFileSizeLow=0x962f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZIYdyOlf_N9Xa2Jzyk3y.swf", cAlternateFileName="ZIYDYO~1.SWF")) returned 1 [0148.282] FindNextFileW (in: hFindFile=0x7a5f8e8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6c72de0, ftCreationTime.dwHighDateTime=0x1d5ef70, ftLastAccessTime.dwLowDateTime=0xb67c0fe0, ftLastAccessTime.dwHighDateTime=0x1d5e1e2, ftLastWriteTime.dwLowDateTime=0xb67c0fe0, ftLastWriteTime.dwHighDateTime=0x1d5e1e2, nFileSizeHigh=0x0, nFileSizeLow=0x962f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZIYdyOlf_N9Xa2Jzyk3y.swf", cAlternateFileName="ZIYDYO~1.SWF")) returned 0 [0148.283] FindClose (in: hFindFile=0x7a5f8e8 | out: hFindFile=0x7a5f8e8) returned 1 [0148.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0148.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0148.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0148.283] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", lpFilePart=0x0) returned 0x31 [0148.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0148.283] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\fsc3mmfkigi0bwi.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.283] GetFileType (hFile=0x2cc) returned 0x1 [0148.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0148.283] GetFileType (hFile=0x2cc) returned 0x1 [0148.283] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x1e84 [0148.284] ReadFile (in: hFile=0x2cc, lpBuffer=0x288b288, nNumberOfBytesToRead=0x1e84, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x288b288*, lpNumberOfBytesRead=0x8febe8*=0x1e84, lpOverlapped=0x0) returned 1 [0148.285] CloseHandle (hObject=0x2cc) returned 1 [0148.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0148.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0148.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0148.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0148.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0148.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0148.371] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", lpFilePart=0x0) returned 0x31 [0148.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0148.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\fsc3mmfkigi0bwi.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.373] GetFileType (hFile=0x2cc) returned 0x1 [0148.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0148.373] GetFileType (hFile=0x2cc) returned 0x1 [0148.373] WriteFile (in: hFile=0x2cc, lpBuffer=0x28e1940*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x28e1940*, lpNumberOfBytesWritten=0x8febdc*=0x1e90, lpOverlapped=0x0) returned 1 [0148.374] CloseHandle (hObject=0x2cc) returned 1 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", nBufferLength=0x32, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4", lpFilePart=0x0) returned 0x31 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0148.381] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4.rogue", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4.rogue", lpFilePart=0x0) returned 0x37 [0148.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0148.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\fsc3mmfkigi0bwi.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe85f5020, ftCreationTime.dwHighDateTime=0x1d5e35a, ftLastAccessTime.dwLowDateTime=0xa27c66f0, ftLastAccessTime.dwHighDateTime=0x1d5edab, ftLastWriteTime.dwLowDateTime=0x612dbf19, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x1e90)) returned 1 [0148.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0148.382] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\fsc3mmfkigi0bwi.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\Fsc3mmfkIGi0bwI.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\fsc3mmfkigi0bwi.mp4.rogue")) returned 1 [0148.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0148.383] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", lpFilePart=0x0) returned 0x34 [0148.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0148.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\oi_qdobi2a7bvnbvb0.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.383] GetFileType (hFile=0x2cc) returned 0x1 [0148.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0148.383] GetFileType (hFile=0x2cc) returned 0x1 [0148.383] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x16a2f [0148.384] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a66a08, nNumberOfBytesToRead=0x16a2f, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x3a66a08*, lpNumberOfBytesRead=0x8febe8*=0x16a2f, lpOverlapped=0x0) returned 1 [0148.386] CloseHandle (hObject=0x2cc) returned 1 [0148.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0148.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0148.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0148.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0148.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0148.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0148.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", lpFilePart=0x0) returned 0x34 [0148.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0148.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\oi_qdobi2a7bvnbvb0.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.607] GetFileType (hFile=0x2cc) returned 0x1 [0148.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0148.607] GetFileType (hFile=0x2cc) returned 0x1 [0148.607] WriteFile (in: hFile=0x2cc, lpBuffer=0x37994c8*, nNumberOfBytesToWrite=0x16a30, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x37994c8*, lpNumberOfBytesWritten=0x8febdc*=0x16a30, lpOverlapped=0x0) returned 1 [0148.610] CloseHandle (hObject=0x2cc) returned 1 [0148.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0148.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", nBufferLength=0x35, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi", lpFilePart=0x0) returned 0x34 [0148.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0148.707] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi.rogue", nBufferLength=0x3b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi.rogue", lpFilePart=0x0) returned 0x3a [0148.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0148.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\oi_qdobi2a7bvnbvb0.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb6d420, ftCreationTime.dwHighDateTime=0x1d5efe9, ftLastAccessTime.dwLowDateTime=0x606c0f20, ftLastAccessTime.dwHighDateTime=0x1d5ee70, ftLastWriteTime.dwLowDateTime=0x615d4849, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16a30)) returned 1 [0148.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0148.724] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\oi_qdobi2a7bvnbvb0.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\oi_QdObi2A7BVNBVb0.avi.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\oi_qdobi2a7bvnbvb0.avi.rogue")) returned 1 [0148.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0148.725] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", lpFilePart=0x0) returned 0x2a [0148.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0148.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\qxn2brnw.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0148.726] GetFileType (hFile=0x2cc) returned 0x1 [0148.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0148.726] GetFileType (hFile=0x2cc) returned 0x1 [0148.726] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x1114b [0148.726] ReadFile (in: hFile=0x2cc, lpBuffer=0x27be670, nNumberOfBytesToRead=0x1114b, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x27be670*, lpNumberOfBytesRead=0x8febe8*=0x1114b, lpOverlapped=0x0) returned 1 [0148.727] CloseHandle (hObject=0x2cc) returned 1 [0149.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.471] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0149.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0149.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0149.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.472] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", lpFilePart=0x0) returned 0x2a [0149.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0149.472] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\qxn2brnw.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.473] GetFileType (hFile=0x2cc) returned 0x1 [0149.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0149.473] GetFileType (hFile=0x2cc) returned 0x1 [0149.473] WriteFile (in: hFile=0x2cc, lpBuffer=0x283e9bc*, nNumberOfBytesToWrite=0x11150, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x283e9bc*, lpNumberOfBytesWritten=0x8febdc*=0x11150, lpOverlapped=0x0) returned 1 [0149.477] CloseHandle (hObject=0x2cc) returned 1 [0149.480] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4", lpFilePart=0x0) returned 0x2a [0149.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0149.481] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4.rogue", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4.rogue", lpFilePart=0x0) returned 0x30 [0149.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0149.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\qxn2brnw.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa433890, ftCreationTime.dwHighDateTime=0x1d5ec17, ftLastAccessTime.dwLowDateTime=0x57c12bd0, ftLastAccessTime.dwHighDateTime=0x1d5e984, ftLastWriteTime.dwLowDateTime=0x61d47f04, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x11150)) returned 1 [0149.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0149.481] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\qxn2brnw.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\amVSwe\\QXN2bRnw.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\amvswe\\qxn2brnw.mp4.rogue")) returned 1 [0149.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0149.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0149.482] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7", nBufferLength=0x1e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7", lpFilePart=0x0) returned 0x1d [0149.483] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9a8 [0149.483] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.483] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa533dbe0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0x5ff48160, ftLastAccessTime.dwHighDateTime=0x1d5e81e, ftLastWriteTime.dwLowDateTime=0x5ff48160, ftLastWriteTime.dwHighDateTime=0x1d5e81e, nFileSizeHigh=0x0, nFileSizeLow=0x16cfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2InH5Kb.mp4", cAlternateFileName="")) returned 1 [0149.483] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7ee90, ftCreationTime.dwHighDateTime=0x1d5e74b, ftLastAccessTime.dwLowDateTime=0x322b2360, ftLastAccessTime.dwHighDateTime=0x1d5eeef, ftLastWriteTime.dwLowDateTime=0x322b2360, ftLastWriteTime.dwHighDateTime=0x1d5eeef, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="n12hozeufQ9o.swf", cAlternateFileName="N12HOZ~1.SWF")) returned 1 [0149.483] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0117c0, ftCreationTime.dwHighDateTime=0x1d5e0b1, ftLastAccessTime.dwLowDateTime=0x4428a690, ftLastAccessTime.dwHighDateTime=0x1d5e64e, ftLastWriteTime.dwLowDateTime=0x4428a690, ftLastWriteTime.dwHighDateTime=0x1d5e64e, nFileSizeHigh=0x0, nFileSizeLow=0x95fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLCWiyddh7A 55yW.swf", cAlternateFileName="RLCWIY~1.SWF")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sP-6fa", cAlternateFileName="")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b451460, ftCreationTime.dwHighDateTime=0x1d5e5d9, ftLastAccessTime.dwLowDateTime=0xb3f41570, ftLastAccessTime.dwHighDateTime=0x1d5e885, ftLastWriteTime.dwLowDateTime=0xb3f41570, ftLastWriteTime.dwHighDateTime=0x1d5e885, nFileSizeHigh=0x0, nFileSizeLow=0x107c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="T-pBh_E.swf", cAlternateFileName="")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7364a220, ftCreationTime.dwHighDateTime=0x1d5ea17, ftLastAccessTime.dwLowDateTime=0x6cb06dd0, ftLastAccessTime.dwHighDateTime=0x1d5ea51, ftLastWriteTime.dwLowDateTime=0x6cb06dd0, ftLastWriteTime.dwHighDateTime=0x1d5ea51, nFileSizeHigh=0x0, nFileSizeLow=0xb9e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="VyF9rBoQyjW 8V3QHk.flv", cAlternateFileName="VYF9RB~1.FLV")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08e2400, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0x98556850, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0x98556850, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x18330, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZS5vKn2GOBGlsK6D7fq6.mp4", cAlternateFileName="ZS5VKN~1.MP4")) returned 1 [0149.484] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.484] FindClose (in: hFindFile=0x7a5f9a8 | out: hFindFile=0x7a5f9a8) returned 1 [0149.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0149.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0149.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec98) returned 1 [0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7", nBufferLength=0x1e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7", lpFilePart=0x0) returned 0x1d [0149.485] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\*", lpFindFileData=0x8fe9c0 | out: lpFindFileData=0x8fe9c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fe28 [0149.485] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc12bcd60, ftCreationTime.dwHighDateTime=0x1d5ea0f, ftLastAccessTime.dwLowDateTime=0xc07ceac0, ftLastAccessTime.dwHighDateTime=0x1d5e2f3, ftLastWriteTime.dwLowDateTime=0xc07ceac0, ftLastWriteTime.dwHighDateTime=0x1d5e2f3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.485] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa533dbe0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0x5ff48160, ftLastAccessTime.dwHighDateTime=0x1d5e81e, ftLastWriteTime.dwLowDateTime=0x5ff48160, ftLastWriteTime.dwHighDateTime=0x1d5e81e, nFileSizeHigh=0x0, nFileSizeLow=0x16cfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="2InH5Kb.mp4", cAlternateFileName="")) returned 1 [0149.485] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a7ee90, ftCreationTime.dwHighDateTime=0x1d5e74b, ftLastAccessTime.dwLowDateTime=0x322b2360, ftLastAccessTime.dwHighDateTime=0x1d5eeef, ftLastWriteTime.dwLowDateTime=0x322b2360, ftLastWriteTime.dwHighDateTime=0x1d5eeef, nFileSizeHigh=0x0, nFileSizeLow=0x4f3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="n12hozeufQ9o.swf", cAlternateFileName="N12HOZ~1.SWF")) returned 1 [0149.485] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c0117c0, ftCreationTime.dwHighDateTime=0x1d5e0b1, ftLastAccessTime.dwLowDateTime=0x4428a690, ftLastAccessTime.dwHighDateTime=0x1d5e64e, ftLastWriteTime.dwLowDateTime=0x4428a690, ftLastWriteTime.dwHighDateTime=0x1d5e64e, nFileSizeHigh=0x0, nFileSizeLow=0x95fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="rLCWiyddh7A 55yW.swf", cAlternateFileName="RLCWIY~1.SWF")) returned 1 [0149.486] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sP-6fa", cAlternateFileName="")) returned 1 [0149.486] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b451460, ftCreationTime.dwHighDateTime=0x1d5e5d9, ftLastAccessTime.dwLowDateTime=0xb3f41570, ftLastAccessTime.dwHighDateTime=0x1d5e885, ftLastWriteTime.dwLowDateTime=0xb3f41570, ftLastWriteTime.dwHighDateTime=0x1d5e885, nFileSizeHigh=0x0, nFileSizeLow=0x107c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="T-pBh_E.swf", cAlternateFileName="")) returned 1 [0149.486] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7364a220, ftCreationTime.dwHighDateTime=0x1d5ea17, ftLastAccessTime.dwLowDateTime=0x6cb06dd0, ftLastAccessTime.dwHighDateTime=0x1d5ea51, ftLastWriteTime.dwLowDateTime=0x6cb06dd0, ftLastWriteTime.dwHighDateTime=0x1d5ea51, nFileSizeHigh=0x0, nFileSizeLow=0xb9e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="VyF9rBoQyjW 8V3QHk.flv", cAlternateFileName="VYF9RB~1.FLV")) returned 1 [0149.486] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08e2400, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0x98556850, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0x98556850, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x18330, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZS5vKn2GOBGlsK6D7fq6.mp4", cAlternateFileName="ZS5VKN~1.MP4")) returned 1 [0149.487] FindNextFileW (in: hFindFile=0x7a5fe28, lpFindFileData=0x8fe9cc | out: lpFindFileData=0x8fe9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08e2400, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0x98556850, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0x98556850, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x18330, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZS5vKn2GOBGlsK6D7fq6.mp4", cAlternateFileName="ZS5VKN~1.MP4")) returned 0 [0149.487] FindClose (in: hFindFile=0x7a5fe28 | out: hFindFile=0x7a5fe28) returned 1 [0149.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec54) returned 1 [0149.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fec60) returned 1 [0149.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0149.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", lpFilePart=0x0) returned 0x29 [0149.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0149.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\2inh5kb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.487] GetFileType (hFile=0x2cc) returned 0x1 [0149.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0149.487] GetFileType (hFile=0x2cc) returned 0x1 [0149.487] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x16cfa [0149.488] ReadFile (in: hFile=0x2cc, lpBuffer=0x3a9f6f8, nNumberOfBytesToRead=0x16cfa, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x3a9f6f8*, lpNumberOfBytesRead=0x8febe8*=0x16cfa, lpOverlapped=0x0) returned 1 [0149.489] CloseHandle (hObject=0x2cc) returned 1 [0149.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0149.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0149.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0149.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0149.598] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", lpFilePart=0x0) returned 0x29 [0149.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0149.598] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\2inh5kb.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.605] GetFileType (hFile=0x2cc) returned 0x1 [0149.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0149.605] GetFileType (hFile=0x2cc) returned 0x1 [0149.605] WriteFile (in: hFile=0x2cc, lpBuffer=0x38239b8*, nNumberOfBytesToWrite=0x16d00, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x38239b8*, lpNumberOfBytesWritten=0x8febdc*=0x16d00, lpOverlapped=0x0) returned 1 [0149.609] CloseHandle (hObject=0x2cc) returned 1 [0149.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0149.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", nBufferLength=0x2a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4", lpFilePart=0x0) returned 0x29 [0149.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0149.693] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4.rogue", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4.rogue", lpFilePart=0x0) returned 0x2f [0149.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0149.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\2inh5kb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa533dbe0, ftCreationTime.dwHighDateTime=0x1d5efc6, ftLastAccessTime.dwLowDateTime=0x5ff48160, ftLastAccessTime.dwHighDateTime=0x1d5e81e, ftLastWriteTime.dwLowDateTime=0x61f5decc, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x16d00)) returned 1 [0149.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0149.694] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\2inh5kb.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\2InH5Kb.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\2inh5kb.mp4.rogue")) returned 1 [0149.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0149.695] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", lpFilePart=0x0) returned 0x36 [0149.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb40) returned 1 [0149.695] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\zs5vkn2gobglsk6d7fq6.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.695] GetFileType (hFile=0x2cc) returned 0x1 [0149.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb3c) returned 1 [0149.695] GetFileType (hFile=0x2cc) returned 0x1 [0149.695] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fec3c | out: lpFileSizeHigh=0x8fec3c*=0x0) returned 0x18330 [0149.695] ReadFile (in: hFile=0x2cc, lpBuffer=0x383a6d8, nNumberOfBytesToRead=0x18330, lpNumberOfBytesRead=0x8febe8, lpOverlapped=0x0 | out: lpBuffer=0x383a6d8*, lpNumberOfBytesRead=0x8febe8*=0x18330, lpOverlapped=0x0) returned 1 [0149.697] CloseHandle (hObject=0x2cc) returned 1 [0149.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0149.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febb4) returned 1 [0149.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8fec30 | out: lpFileInformation=0x8fec30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febb0) returned 1 [0149.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0149.744] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", lpFilePart=0x0) returned 0x36 [0149.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb2c) returned 1 [0149.745] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\zs5vkn2gobglsk6d7fq6.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.746] GetFileType (hFile=0x2cc) returned 0x1 [0149.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb28) returned 1 [0149.746] GetFileType (hFile=0x2cc) returned 0x1 [0149.746] WriteFile (in: hFile=0x2cc, lpBuffer=0x38b3748*, nNumberOfBytesToWrite=0x18340, lpNumberOfBytesWritten=0x8febdc, lpOverlapped=0x0 | out: lpBuffer=0x38b3748*, lpNumberOfBytesWritten=0x8febdc*=0x18340, lpOverlapped=0x0) returned 1 [0149.749] CloseHandle (hObject=0x2cc) returned 1 [0149.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0149.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", nBufferLength=0x37, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4", lpFilePart=0x0) returned 0x36 [0149.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0149.807] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4.rogue", nBufferLength=0x3d, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4.rogue", lpFilePart=0x0) returned 0x3c [0149.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8febc0) returned 1 [0149.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\zs5vkn2gobglsk6d7fq6.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fec3c | out: lpFileInformation=0x8fec3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08e2400, ftCreationTime.dwHighDateTime=0x1d5e153, ftLastAccessTime.dwLowDateTime=0x98556850, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0x620690d5, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x18340)) returned 1 [0149.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febbc) returned 1 [0149.807] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\zs5vkn2gobglsk6d7fq6.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\ZS5vKn2GOBGlsK6D7fq6.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\zs5vkn2gobglsk6d7fq6.mp4.rogue")) returned 1 [0149.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0149.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0149.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", lpFilePart=0x0) returned 0x24 [0149.808] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fee8 [0149.809] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.809] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5672fc50, ftCreationTime.dwHighDateTime=0x1d5eee7, ftLastAccessTime.dwLowDateTime=0x44888240, ftLastAccessTime.dwHighDateTime=0x1d5e7ed, ftLastWriteTime.dwLowDateTime=0x44888240, ftLastWriteTime.dwHighDateTime=0x1d5e7ed, nFileSizeHigh=0x0, nFileSizeLow=0x1753c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1VG01G516W9l7ADb3.swf", cAlternateFileName="1VG01G~1.SWF")) returned 1 [0149.809] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde124830, ftCreationTime.dwHighDateTime=0x1d5e606, ftLastAccessTime.dwLowDateTime=0x82f63b60, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x82f63b60, ftLastWriteTime.dwHighDateTime=0x1d5e0e7, nFileSizeHigh=0x0, nFileSizeLow=0x41a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="egf2_9m6UD6Pwwm 8L _.avi", cAlternateFileName="EGF2_9~1.AVI")) returned 1 [0149.809] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhxiISsMcq", cAlternateFileName="IHXIIS~1")) returned 1 [0149.809] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="o2YBowEXKT9OUSbWjZUd", cAlternateFileName="O2YBOW~1")) returned 1 [0149.810] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe05b00, ftCreationTime.dwHighDateTime=0x1d5ef57, ftLastAccessTime.dwLowDateTime=0xa4bb5ff0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xa4bb5ff0, ftLastWriteTime.dwHighDateTime=0x1d5e754, nFileSizeHigh=0x0, nFileSizeLow=0x106fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="P0pCMn9yc54M4uJ7w.swf", cAlternateFileName="P0PCMN~1.SWF")) returned 1 [0149.810] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNFo1R", cAlternateFileName="")) returned 1 [0149.810] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNFo1R", cAlternateFileName="")) returned 0 [0149.810] FindClose (in: hFindFile=0x7a5fee8 | out: hFindFile=0x7a5fee8) returned 1 [0149.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0149.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0149.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fec20) returned 1 [0149.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x25 [0149.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", nBufferLength=0x25, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa", lpFilePart=0x0) returned 0x24 [0149.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\*", lpFindFileData=0x8fe948 | out: lpFindFileData=0x8fe948*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5faa8 [0149.811] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa42c8cc0, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7340c980, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x7340c980, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.811] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5672fc50, ftCreationTime.dwHighDateTime=0x1d5eee7, ftLastAccessTime.dwLowDateTime=0x44888240, ftLastAccessTime.dwHighDateTime=0x1d5e7ed, ftLastWriteTime.dwLowDateTime=0x44888240, ftLastWriteTime.dwHighDateTime=0x1d5e7ed, nFileSizeHigh=0x0, nFileSizeLow=0x1753c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1VG01G516W9l7ADb3.swf", cAlternateFileName="1VG01G~1.SWF")) returned 1 [0149.811] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde124830, ftCreationTime.dwHighDateTime=0x1d5e606, ftLastAccessTime.dwLowDateTime=0x82f63b60, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x82f63b60, ftLastWriteTime.dwHighDateTime=0x1d5e0e7, nFileSizeHigh=0x0, nFileSizeLow=0x41a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="egf2_9m6UD6Pwwm 8L _.avi", cAlternateFileName="EGF2_9~1.AVI")) returned 1 [0149.811] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IhxiISsMcq", cAlternateFileName="IHXIIS~1")) returned 1 [0149.812] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="o2YBowEXKT9OUSbWjZUd", cAlternateFileName="O2YBOW~1")) returned 1 [0149.812] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe05b00, ftCreationTime.dwHighDateTime=0x1d5ef57, ftLastAccessTime.dwLowDateTime=0xa4bb5ff0, ftLastAccessTime.dwHighDateTime=0x1d5e754, ftLastWriteTime.dwLowDateTime=0xa4bb5ff0, ftLastWriteTime.dwHighDateTime=0x1d5e754, nFileSizeHigh=0x0, nFileSizeLow=0x106fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="P0pCMn9yc54M4uJ7w.swf", cAlternateFileName="P0PCMN~1.SWF")) returned 1 [0149.812] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zNFo1R", cAlternateFileName="")) returned 1 [0149.812] FindNextFileW (in: hFindFile=0x7a5faa8, lpFindFileData=0x8fe954 | out: lpFindFileData=0x8fe954*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.812] FindClose (in: hFindFile=0x7a5faa8 | out: hFindFile=0x7a5faa8) returned 1 [0149.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febdc) returned 1 [0149.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8febe8) returned 1 [0149.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0149.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", lpFilePart=0x0) returned 0x3d [0149.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac8) returned 1 [0149.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\egf2_9m6ud6pwwm 8l _.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.813] GetFileType (hFile=0x2cc) returned 0x1 [0149.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac4) returned 1 [0149.813] GetFileType (hFile=0x2cc) returned 0x1 [0149.813] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8febc4 | out: lpFileSizeHigh=0x8febc4*=0x0) returned 0x41a1 [0149.813] ReadFile (in: hFile=0x2cc, lpBuffer=0x28ed89c, nNumberOfBytesToRead=0x41a1, lpNumberOfBytesRead=0x8feb70, lpOverlapped=0x0 | out: lpBuffer=0x28ed89c*, lpNumberOfBytesRead=0x8feb70*=0x41a1, lpOverlapped=0x0) returned 1 [0149.814] CloseHandle (hObject=0x2cc) returned 1 [0149.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.834] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0149.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb3c) returned 1 [0149.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8febb8 | out: lpFileInformation=0x8febb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb38) returned 1 [0149.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0149.835] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", lpFilePart=0x0) returned 0x3d [0149.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feab4) returned 1 [0149.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\egf2_9m6ud6pwwm 8l _.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.836] GetFileType (hFile=0x2cc) returned 0x1 [0149.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feab0) returned 1 [0149.836] GetFileType (hFile=0x2cc) returned 0x1 [0149.836] WriteFile (in: hFile=0x2cc, lpBuffer=0x294eef8*, nNumberOfBytesToWrite=0x41b0, lpNumberOfBytesWritten=0x8feb64, lpOverlapped=0x0 | out: lpBuffer=0x294eef8*, lpNumberOfBytesWritten=0x8feb64*=0x41b0, lpOverlapped=0x0) returned 1 [0149.838] CloseHandle (hObject=0x2cc) returned 1 [0149.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0149.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi", lpFilePart=0x0) returned 0x3d [0149.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0149.842] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi.rogue", nBufferLength=0x44, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi.rogue", lpFilePart=0x0) returned 0x43 [0149.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb48) returned 1 [0149.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\egf2_9m6ud6pwwm 8l _.avi"), fInfoLevelId=0x0, lpFileInformation=0x8febc4 | out: lpFileInformation=0x8febc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde124830, ftCreationTime.dwHighDateTime=0x1d5e606, ftLastAccessTime.dwLowDateTime=0x82f63b60, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x620b55a7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x41b0)) returned 1 [0149.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb44) returned 1 [0149.843] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\egf2_9m6ud6pwwm 8l _.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\egf2_9m6UD6Pwwm 8L _.avi.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\egf2_9m6ud6pwwm 8l _.avi.rogue")) returned 1 [0149.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0149.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0149.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", lpFilePart=0x0) returned 0x2f [0149.844] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fc68 [0149.844] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.844] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FnphE-atdZvFk3A75l", cAlternateFileName="FNPHE-~1")) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f12770, ftCreationTime.dwHighDateTime=0x1d5edc4, ftLastAccessTime.dwLowDateTime=0xe0a231e0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0xe0a231e0, ftLastWriteTime.dwHighDateTime=0x1d5e927, nFileSizeHigh=0x0, nFileSizeLow=0xf992, dwReserved0=0x0, dwReserved1=0x0, cFileName="Js9iVsNx_VZr.mkv", cAlternateFileName="JS9IVS~1.MKV")) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefbd280, ftCreationTime.dwHighDateTime=0x1d5f06d, ftLastAccessTime.dwLowDateTime=0xcc09a250, ftLastAccessTime.dwHighDateTime=0x1d5f024, ftLastWriteTime.dwLowDateTime=0xcc09a250, ftLastWriteTime.dwHighDateTime=0x1d5f024, nFileSizeHigh=0x0, nFileSizeLow=0xb813, dwReserved0=0x0, dwReserved1=0x0, cFileName="JzSlsm4bT5jN.mkv", cAlternateFileName="JZSLSM~1.MKV")) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc05c3fc0, ftCreationTime.dwHighDateTime=0x1d5eabc, ftLastAccessTime.dwLowDateTime=0x11fdc6e0, ftLastAccessTime.dwHighDateTime=0x1d5ee56, ftLastWriteTime.dwLowDateTime=0x11fdc6e0, ftLastWriteTime.dwHighDateTime=0x1d5ee56, nFileSizeHigh=0x0, nFileSizeLow=0x87f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PfTcHO _RLzaWCYaMrwJ.flv", cAlternateFileName="PFTCHO~1.FLV")) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3db460, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xd26ee980, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xd26ee980, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x16116, dwReserved0=0x0, dwReserved1=0x0, cFileName="poLPm5L6eJDZyF3h.swf", cAlternateFileName="POLPM5~1.SWF")) returned 1 [0149.845] FindNextFileW (in: hFindFile=0x7a5fc68, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.845] FindClose (in: hFindFile=0x7a5fc68 | out: hFindFile=0x7a5fc68) returned 1 [0149.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0149.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0149.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0149.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0149.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", nBufferLength=0x30, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq", lpFilePart=0x0) returned 0x2f [0149.846] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f928 [0149.846] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838b5c0, ftCreationTime.dwHighDateTime=0x1d5eca4, ftLastAccessTime.dwLowDateTime=0x88c5b2c0, ftLastAccessTime.dwHighDateTime=0x1d5e162, ftLastWriteTime.dwLowDateTime=0x88c5b2c0, ftLastWriteTime.dwHighDateTime=0x1d5e162, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.846] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FnphE-atdZvFk3A75l", cAlternateFileName="FNPHE-~1")) returned 1 [0149.846] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f12770, ftCreationTime.dwHighDateTime=0x1d5edc4, ftLastAccessTime.dwLowDateTime=0xe0a231e0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0xe0a231e0, ftLastWriteTime.dwHighDateTime=0x1d5e927, nFileSizeHigh=0x0, nFileSizeLow=0xf992, dwReserved0=0x0, dwReserved1=0x0, cFileName="Js9iVsNx_VZr.mkv", cAlternateFileName="JS9IVS~1.MKV")) returned 1 [0149.846] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefbd280, ftCreationTime.dwHighDateTime=0x1d5f06d, ftLastAccessTime.dwLowDateTime=0xcc09a250, ftLastAccessTime.dwHighDateTime=0x1d5f024, ftLastWriteTime.dwLowDateTime=0xcc09a250, ftLastWriteTime.dwHighDateTime=0x1d5f024, nFileSizeHigh=0x0, nFileSizeLow=0xb813, dwReserved0=0x0, dwReserved1=0x0, cFileName="JzSlsm4bT5jN.mkv", cAlternateFileName="JZSLSM~1.MKV")) returned 1 [0149.847] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc05c3fc0, ftCreationTime.dwHighDateTime=0x1d5eabc, ftLastAccessTime.dwLowDateTime=0x11fdc6e0, ftLastAccessTime.dwHighDateTime=0x1d5ee56, ftLastWriteTime.dwLowDateTime=0x11fdc6e0, ftLastWriteTime.dwHighDateTime=0x1d5ee56, nFileSizeHigh=0x0, nFileSizeLow=0x87f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PfTcHO _RLzaWCYaMrwJ.flv", cAlternateFileName="PFTCHO~1.FLV")) returned 1 [0149.847] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3db460, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xd26ee980, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xd26ee980, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x16116, dwReserved0=0x0, dwReserved1=0x0, cFileName="poLPm5L6eJDZyF3h.swf", cAlternateFileName="POLPM5~1.SWF")) returned 1 [0149.847] FindNextFileW (in: hFindFile=0x7a5f928, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3db460, ftCreationTime.dwHighDateTime=0x1d5e205, ftLastAccessTime.dwLowDateTime=0xd26ee980, ftLastAccessTime.dwHighDateTime=0x1d5e448, ftLastWriteTime.dwLowDateTime=0xd26ee980, ftLastWriteTime.dwHighDateTime=0x1d5e448, nFileSizeHigh=0x0, nFileSizeLow=0x16116, dwReserved0=0x0, dwReserved1=0x0, cFileName="poLPm5L6eJDZyF3h.swf", cAlternateFileName="POLPM5~1.SWF")) returned 0 [0149.847] FindClose (in: hFindFile=0x7a5f928 | out: hFindFile=0x7a5f928) returned 1 [0149.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0149.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", lpFilePart=0x0) returned 0x40 [0149.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0149.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\js9ivsnx_vzr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.848] GetFileType (hFile=0x2cc) returned 0x1 [0149.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0149.848] GetFileType (hFile=0x2cc) returned 0x1 [0149.909] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0xf992 [0149.909] ReadFile (in: hFile=0x2cc, lpBuffer=0x295517c, nNumberOfBytesToRead=0xf992, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x295517c*, lpNumberOfBytesRead=0x8feaf8*=0xf992, lpOverlapped=0x0) returned 1 [0149.912] CloseHandle (hObject=0x2cc) returned 1 [0149.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0149.943] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0149.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0149.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0149.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0149.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0149.944] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", lpFilePart=0x0) returned 0x40 [0149.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0149.944] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\js9ivsnx_vzr.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.946] GetFileType (hFile=0x2cc) returned 0x1 [0149.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0149.946] GetFileType (hFile=0x2cc) returned 0x1 [0149.946] WriteFile (in: hFile=0x2cc, lpBuffer=0x27ee7bc*, nNumberOfBytesToWrite=0xf9a0, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x27ee7bc*, lpNumberOfBytesWritten=0x8feaec*=0xf9a0, lpOverlapped=0x0) returned 1 [0149.948] CloseHandle (hObject=0x2cc) returned 1 [0149.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0149.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv", lpFilePart=0x0) returned 0x40 [0149.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0149.951] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv.rogue", nBufferLength=0x47, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv.rogue", lpFilePart=0x0) returned 0x46 [0149.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0149.952] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\js9ivsnx_vzr.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f12770, ftCreationTime.dwHighDateTime=0x1d5edc4, ftLastAccessTime.dwLowDateTime=0xe0a231e0, ftLastAccessTime.dwHighDateTime=0x1d5e927, ftLastWriteTime.dwLowDateTime=0x621c050d, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xf9a0)) returned 1 [0149.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0149.952] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\js9ivsnx_vzr.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\Js9iVsNx_VZr.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\js9ivsnx_vzr.mkv.rogue")) returned 1 [0149.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0149.953] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", lpFilePart=0x0) returned 0x40 [0149.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0149.953] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\jzslsm4bt5jn.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0149.953] GetFileType (hFile=0x2cc) returned 0x1 [0149.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0149.953] GetFileType (hFile=0x2cc) returned 0x1 [0149.953] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0xb813 [0149.953] ReadFile (in: hFile=0x2cc, lpBuffer=0x27fe3f4, nNumberOfBytesToRead=0xb813, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x27fe3f4*, lpNumberOfBytesRead=0x8feaf8*=0xb813, lpOverlapped=0x0) returned 1 [0149.955] CloseHandle (hObject=0x2cc) returned 1 [0150.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0150.146] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0150.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0150.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0150.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0150.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0150.147] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", lpFilePart=0x0) returned 0x40 [0150.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0150.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\jzslsm4bt5jn.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.149] GetFileType (hFile=0x2cc) returned 0x1 [0150.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0150.149] GetFileType (hFile=0x2cc) returned 0x1 [0150.149] WriteFile (in: hFile=0x2cc, lpBuffer=0x286dbb0*, nNumberOfBytesToWrite=0xb820, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x286dbb0*, lpNumberOfBytesWritten=0x8feaec*=0xb820, lpOverlapped=0x0) returned 1 [0150.151] CloseHandle (hObject=0x2cc) returned 1 [0150.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0150.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", nBufferLength=0x41, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv", lpFilePart=0x0) returned 0x40 [0150.156] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0150.157] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv.rogue", nBufferLength=0x47, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv.rogue", lpFilePart=0x0) returned 0x46 [0150.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0150.157] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\jzslsm4bt5jn.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefbd280, ftCreationTime.dwHighDateTime=0x1d5f06d, ftLastAccessTime.dwLowDateTime=0xcc09a250, ftLastAccessTime.dwHighDateTime=0x1d5f024, ftLastWriteTime.dwLowDateTime=0x623b061b, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xb820)) returned 1 [0150.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0150.157] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\jzslsm4bt5jn.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\JzSlsm4bT5jN.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\jzslsm4bt5jn.mkv.rogue")) returned 1 [0150.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb30) returned 1 [0150.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0150.158] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", nBufferLength=0x43, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", lpFilePart=0x0) returned 0x42 [0150.158] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\*", lpFindFileData=0x8fe858 | out: lpFindFileData=0x8fe858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fee8 [0150.158] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbba69f0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xb4cbc7c0, ftLastAccessTime.dwHighDateTime=0x1d5e9f9, ftLastWriteTime.dwLowDateTime=0xb4cbc7c0, ftLastWriteTime.dwHighDateTime=0x1d5e9f9, nFileSizeHigh=0x0, nFileSizeLow=0x2059, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NAWg9dKQtzSDwFZa3o.mp4", cAlternateFileName="-NAWG9~1.MP4")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b023ae0, ftCreationTime.dwHighDateTime=0x1d5ee92, ftLastAccessTime.dwLowDateTime=0x307ce1a0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0x307ce1a0, ftLastWriteTime.dwHighDateTime=0x1d5ed43, nFileSizeHigh=0x0, nFileSizeLow=0x105e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cHkVqllQ rz.mp4", cAlternateFileName="CHKVQL~1.MP4")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164957f0, ftCreationTime.dwHighDateTime=0x1d5ef82, ftLastAccessTime.dwLowDateTime=0x33d669c0, ftLastAccessTime.dwHighDateTime=0x1d5eeec, ftLastWriteTime.dwLowDateTime=0x33d669c0, ftLastWriteTime.dwHighDateTime=0x1d5eeec, nFileSizeHigh=0x0, nFileSizeLow=0xc87a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMJwpNA.avi", cAlternateFileName="")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d62eae0, ftCreationTime.dwHighDateTime=0x1d5e6ef, ftLastAccessTime.dwLowDateTime=0xcfe4550, ftLastAccessTime.dwHighDateTime=0x1d5edbd, ftLastWriteTime.dwLowDateTime=0xcfe4550, ftLastWriteTime.dwHighDateTime=0x1d5edbd, nFileSizeHigh=0x0, nFileSizeLow=0x4dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mp EK7D5YDEj7.mkv", cAlternateFileName="MPEK7D~1.MKV")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46ac7630, ftCreationTime.dwHighDateTime=0x1d5eb7b, ftLastAccessTime.dwLowDateTime=0x806e8920, ftLastAccessTime.dwHighDateTime=0x1d5ebea, ftLastWriteTime.dwLowDateTime=0x806e8920, ftLastWriteTime.dwHighDateTime=0x1d5ebea, nFileSizeHigh=0x0, nFileSizeLow=0x352b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFwzI4TQavhN1xpJpS6K.flv", cAlternateFileName="OFWZI4~1.FLV")) returned 1 [0150.159] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7718420, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x9c2d7ef0, ftLastAccessTime.dwHighDateTime=0x1d5f068, ftLastWriteTime.dwLowDateTime=0x9c2d7ef0, ftLastWriteTime.dwHighDateTime=0x1d5f068, nFileSizeHigh=0x0, nFileSizeLow=0x8cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWgPmK9DCaGnHgbEDF.swf", cAlternateFileName="UWGPMK~1.SWF")) returned 1 [0150.160] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74adc610, ftCreationTime.dwHighDateTime=0x1d5e397, ftLastAccessTime.dwLowDateTime=0x7224d1b0, ftLastAccessTime.dwHighDateTime=0x1d5e7ff, ftLastWriteTime.dwLowDateTime=0x7224d1b0, ftLastWriteTime.dwHighDateTime=0x1d5e7ff, nFileSizeHigh=0x0, nFileSizeLow=0xe2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZXuey.mp4", cAlternateFileName="")) returned 1 [0150.160] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.160] FindClose (in: hFindFile=0x7a5fee8 | out: hFindFile=0x7a5fee8) returned 1 [0150.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feaec) returned 1 [0150.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feaf8) returned 1 [0150.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feb30) returned 1 [0150.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0150.160] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", nBufferLength=0x43, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l", lpFilePart=0x0) returned 0x42 [0150.160] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\*", lpFindFileData=0x8fe858 | out: lpFindFileData=0x8fe858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5f9a8 [0150.346] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x317f9310, ftCreationTime.dwHighDateTime=0x1d5eb6b, ftLastAccessTime.dwLowDateTime=0xdc99d3c0, ftLastAccessTime.dwHighDateTime=0x1d5e46b, ftLastWriteTime.dwLowDateTime=0xdc99d3c0, ftLastWriteTime.dwHighDateTime=0x1d5e46b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.346] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbba69f0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xb4cbc7c0, ftLastAccessTime.dwHighDateTime=0x1d5e9f9, ftLastWriteTime.dwLowDateTime=0xb4cbc7c0, ftLastWriteTime.dwHighDateTime=0x1d5e9f9, nFileSizeHigh=0x0, nFileSizeLow=0x2059, dwReserved0=0x0, dwReserved1=0x0, cFileName="-NAWg9dKQtzSDwFZa3o.mp4", cAlternateFileName="-NAWG9~1.MP4")) returned 1 [0150.638] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b023ae0, ftCreationTime.dwHighDateTime=0x1d5ee92, ftLastAccessTime.dwLowDateTime=0x307ce1a0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0x307ce1a0, ftLastWriteTime.dwHighDateTime=0x1d5ed43, nFileSizeHigh=0x0, nFileSizeLow=0x105e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="cHkVqllQ rz.mp4", cAlternateFileName="CHKVQL~1.MP4")) returned 1 [0150.638] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164957f0, ftCreationTime.dwHighDateTime=0x1d5ef82, ftLastAccessTime.dwLowDateTime=0x33d669c0, ftLastAccessTime.dwHighDateTime=0x1d5eeec, ftLastWriteTime.dwLowDateTime=0x33d669c0, ftLastWriteTime.dwHighDateTime=0x1d5eeec, nFileSizeHigh=0x0, nFileSizeLow=0xc87a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMJwpNA.avi", cAlternateFileName="")) returned 1 [0150.638] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d62eae0, ftCreationTime.dwHighDateTime=0x1d5e6ef, ftLastAccessTime.dwLowDateTime=0xcfe4550, ftLastAccessTime.dwHighDateTime=0x1d5edbd, ftLastWriteTime.dwLowDateTime=0xcfe4550, ftLastWriteTime.dwHighDateTime=0x1d5edbd, nFileSizeHigh=0x0, nFileSizeLow=0x4dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mp EK7D5YDEj7.mkv", cAlternateFileName="MPEK7D~1.MKV")) returned 1 [0150.639] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46ac7630, ftCreationTime.dwHighDateTime=0x1d5eb7b, ftLastAccessTime.dwLowDateTime=0x806e8920, ftLastAccessTime.dwHighDateTime=0x1d5ebea, ftLastWriteTime.dwLowDateTime=0x806e8920, ftLastWriteTime.dwHighDateTime=0x1d5ebea, nFileSizeHigh=0x0, nFileSizeLow=0x352b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oFwzI4TQavhN1xpJpS6K.flv", cAlternateFileName="OFWZI4~1.FLV")) returned 1 [0150.639] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7718420, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x9c2d7ef0, ftLastAccessTime.dwHighDateTime=0x1d5f068, ftLastWriteTime.dwLowDateTime=0x9c2d7ef0, ftLastWriteTime.dwHighDateTime=0x1d5f068, nFileSizeHigh=0x0, nFileSizeLow=0x8cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="uWgPmK9DCaGnHgbEDF.swf", cAlternateFileName="UWGPMK~1.SWF")) returned 1 [0150.639] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74adc610, ftCreationTime.dwHighDateTime=0x1d5e397, ftLastAccessTime.dwLowDateTime=0x7224d1b0, ftLastAccessTime.dwHighDateTime=0x1d5e7ff, ftLastWriteTime.dwLowDateTime=0x7224d1b0, ftLastWriteTime.dwHighDateTime=0x1d5e7ff, nFileSizeHigh=0x0, nFileSizeLow=0xe2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZXuey.mp4", cAlternateFileName="")) returned 1 [0150.639] FindNextFileW (in: hFindFile=0x7a5f9a8, lpFindFileData=0x8fe864 | out: lpFindFileData=0x8fe864*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74adc610, ftCreationTime.dwHighDateTime=0x1d5e397, ftLastAccessTime.dwLowDateTime=0x7224d1b0, ftLastAccessTime.dwHighDateTime=0x1d5e7ff, ftLastWriteTime.dwLowDateTime=0x7224d1b0, ftLastWriteTime.dwHighDateTime=0x1d5e7ff, nFileSizeHigh=0x0, nFileSizeLow=0xe2a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VZXuey.mp4", cAlternateFileName="")) returned 0 [0150.640] FindClose (in: hFindFile=0x7a5f9a8 | out: hFindFile=0x7a5f9a8) returned 1 [0150.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feaec) returned 1 [0150.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feaf8) returned 1 [0150.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0150.640] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", lpFilePart=0x0) returned 0x5a [0150.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9d8) returned 1 [0150.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\-nawg9dkqtzsdwfza3o.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.641] GetFileType (hFile=0x2cc) returned 0x1 [0150.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9d4) returned 1 [0150.641] GetFileType (hFile=0x2cc) returned 0x1 [0150.641] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fead4 | out: lpFileSizeHigh=0x8fead4*=0x0) returned 0x2059 [0150.641] ReadFile (in: hFile=0x2cc, lpBuffer=0x287c144, nNumberOfBytesToRead=0x2059, lpNumberOfBytesRead=0x8fea80, lpOverlapped=0x0 | out: lpBuffer=0x287c144*, lpNumberOfBytesRead=0x8fea80*=0x2059, lpOverlapped=0x0) returned 1 [0150.642] CloseHandle (hObject=0x2cc) returned 1 [0150.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0150.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0150.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea4c) returned 1 [0150.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feac8 | out: lpFileInformation=0x8feac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0150.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea48) returned 1 [0150.670] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0150.671] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", lpFilePart=0x0) returned 0x5a [0150.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9c4) returned 1 [0150.671] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\-nawg9dkqtzsdwfza3o.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.672] GetFileType (hFile=0x2cc) returned 0x1 [0150.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9c0) returned 1 [0150.672] GetFileType (hFile=0x2cc) returned 0x1 [0150.673] WriteFile (in: hFile=0x2cc, lpBuffer=0x28d3110*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x8fea74, lpOverlapped=0x0 | out: lpBuffer=0x28d3110*, lpNumberOfBytesWritten=0x8fea74*=0x2060, lpOverlapped=0x0) returned 1 [0150.674] CloseHandle (hObject=0x2cc) returned 1 [0150.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0150.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4", lpFilePart=0x0) returned 0x5a [0150.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x61 [0150.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4.rogue", nBufferLength=0x61, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4.rogue", lpFilePart=0x0) returned 0x60 [0150.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea58) returned 1 [0150.808] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\-nawg9dkqtzsdwfza3o.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fead4 | out: lpFileInformation=0x8fead4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbba69f0, ftCreationTime.dwHighDateTime=0x1d5e12e, ftLastAccessTime.dwLowDateTime=0xb4cbc7c0, ftLastAccessTime.dwHighDateTime=0x1d5e9f9, ftLastWriteTime.dwLowDateTime=0x629de7b4, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x2060)) returned 1 [0150.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea54) returned 1 [0150.808] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\-nawg9dkqtzsdwfza3o.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\-NAWg9dKQtzSDwFZa3o.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\-nawg9dkqtzsdwfza3o.mp4.rogue")) returned 1 [0150.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0150.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", lpFilePart=0x0) returned 0x52 [0150.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9d8) returned 1 [0150.809] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\chkvqllq rz.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.810] GetFileType (hFile=0x2cc) returned 0x1 [0150.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9d4) returned 1 [0150.810] GetFileType (hFile=0x2cc) returned 0x1 [0150.810] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fead4 | out: lpFileSizeHigh=0x8fead4*=0x0) returned 0x105e3 [0150.810] ReadFile (in: hFile=0x2cc, lpBuffer=0x28d5444, nNumberOfBytesToRead=0x105e3, lpNumberOfBytesRead=0x8fea80, lpOverlapped=0x0 | out: lpBuffer=0x28d5444*, lpNumberOfBytesRead=0x8fea80*=0x105e3, lpOverlapped=0x0) returned 1 [0150.811] CloseHandle (hObject=0x2cc) returned 1 [0150.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0150.946] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0150.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea4c) returned 1 [0150.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feac8 | out: lpFileInformation=0x8feac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0150.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea48) returned 1 [0150.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0150.947] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", lpFilePart=0x0) returned 0x52 [0150.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9c4) returned 1 [0150.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\chkvqllq rz.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.949] GetFileType (hFile=0x2cc) returned 0x1 [0150.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9c0) returned 1 [0150.949] GetFileType (hFile=0x2cc) returned 0x1 [0150.949] WriteFile (in: hFile=0x2cc, lpBuffer=0x2953414*, nNumberOfBytesToWrite=0x105f0, lpNumberOfBytesWritten=0x8fea74, lpOverlapped=0x0 | out: lpBuffer=0x2953414*, lpNumberOfBytesWritten=0x8fea74*=0x105f0, lpOverlapped=0x0) returned 1 [0150.952] CloseHandle (hObject=0x2cc) returned 1 [0150.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0150.956] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4", lpFilePart=0x0) returned 0x52 [0150.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0150.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4.rogue", nBufferLength=0x59, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4.rogue", lpFilePart=0x0) returned 0x58 [0150.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea58) returned 1 [0150.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\chkvqllq rz.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fead4 | out: lpFileInformation=0x8fead4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b023ae0, ftCreationTime.dwHighDateTime=0x1d5ee92, ftLastAccessTime.dwLowDateTime=0x307ce1a0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0x62b5bfbe, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x105f0)) returned 1 [0150.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea54) returned 1 [0150.957] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\chkvqllq rz.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\cHkVqllQ rz.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\chkvqllq rz.mp4.rogue")) returned 1 [0150.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0150.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x4f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", lpFilePart=0x0) returned 0x4e [0150.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9d8) returned 1 [0150.978] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mmjwpna.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0150.978] GetFileType (hFile=0x2cc) returned 0x1 [0150.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9d4) returned 1 [0150.978] GetFileType (hFile=0x2cc) returned 0x1 [0150.978] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fead4 | out: lpFileSizeHigh=0x8fead4*=0x0) returned 0xc87a [0150.978] ReadFile (in: hFile=0x2cc, lpBuffer=0x2963cb0, nNumberOfBytesToRead=0xc87a, lpNumberOfBytesRead=0x8fea80, lpOverlapped=0x0 | out: lpBuffer=0x2963cb0*, lpNumberOfBytesRead=0x8fea80*=0xc87a, lpOverlapped=0x0) returned 1 [0150.980] CloseHandle (hObject=0x2cc) returned 1 [0151.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.082] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea4c) returned 1 [0151.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feac8 | out: lpFileInformation=0x8feac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea48) returned 1 [0151.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0151.084] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x4f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", lpFilePart=0x0) returned 0x4e [0151.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9c4) returned 1 [0151.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mmjwpna.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.086] GetFileType (hFile=0x2cc) returned 0x1 [0151.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9c0) returned 1 [0151.086] GetFileType (hFile=0x2cc) returned 0x1 [0151.087] WriteFile (in: hFile=0x2cc, lpBuffer=0x29d6430*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x8fea74, lpOverlapped=0x0 | out: lpBuffer=0x29d6430*, lpNumberOfBytesWritten=0x8fea74*=0xc880, lpOverlapped=0x0) returned 1 [0151.089] CloseHandle (hObject=0x2cc) returned 1 [0151.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0151.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", nBufferLength=0x4f, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi", lpFilePart=0x0) returned 0x4e [0151.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0151.093] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi.rogue", nBufferLength=0x55, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi.rogue", lpFilePart=0x0) returned 0x54 [0151.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea58) returned 1 [0151.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mmjwpna.avi"), fInfoLevelId=0x0, lpFileInformation=0x8fead4 | out: lpFileInformation=0x8fead4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164957f0, ftCreationTime.dwHighDateTime=0x1d5ef82, ftLastAccessTime.dwLowDateTime=0x33d669c0, ftLastAccessTime.dwHighDateTime=0x1d5eeec, ftLastWriteTime.dwLowDateTime=0x62cb3765, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xc880)) returned 1 [0151.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea54) returned 1 [0151.093] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mmjwpna.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\MMJwpNA.avi.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mmjwpna.avi.rogue")) returned 1 [0151.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0151.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x55, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", lpFilePart=0x0) returned 0x54 [0151.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9d8) returned 1 [0151.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mp ek7d5ydej7.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.095] GetFileType (hFile=0x2cc) returned 0x1 [0151.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9d4) returned 1 [0151.095] GetFileType (hFile=0x2cc) returned 0x1 [0151.095] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fead4 | out: lpFileSizeHigh=0x8fead4*=0x0) returned 0x4dc5 [0151.100] ReadFile (in: hFile=0x2cc, lpBuffer=0x27df578, nNumberOfBytesToRead=0x4dc5, lpNumberOfBytesRead=0x8fea80, lpOverlapped=0x0 | out: lpBuffer=0x27df578*, lpNumberOfBytesRead=0x8fea80*=0x4dc5, lpOverlapped=0x0) returned 1 [0151.101] CloseHandle (hObject=0x2cc) returned 1 [0151.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.338] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea4c) returned 1 [0151.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feac8 | out: lpFileInformation=0x8feac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea48) returned 1 [0151.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0151.339] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x55, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", lpFilePart=0x0) returned 0x54 [0151.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9c4) returned 1 [0151.339] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mp ek7d5ydej7.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.402] GetFileType (hFile=0x2cc) returned 0x1 [0151.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9c0) returned 1 [0151.402] GetFileType (hFile=0x2cc) returned 0x1 [0151.402] WriteFile (in: hFile=0x2cc, lpBuffer=0x28449d0*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x8fea74, lpOverlapped=0x0 | out: lpBuffer=0x28449d0*, lpNumberOfBytesWritten=0x8fea74*=0x4dd0, lpOverlapped=0x0) returned 1 [0151.404] CloseHandle (hObject=0x2cc) returned 1 [0151.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0151.408] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", nBufferLength=0x55, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv", lpFilePart=0x0) returned 0x54 [0151.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0151.409] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv.rogue", nBufferLength=0x5b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv.rogue", lpFilePart=0x0) returned 0x5a [0151.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea58) returned 1 [0151.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mp ek7d5ydej7.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8fead4 | out: lpFileInformation=0x8fead4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d62eae0, ftCreationTime.dwHighDateTime=0x1d5e6ef, ftLastAccessTime.dwLowDateTime=0xcfe4550, ftLastAccessTime.dwHighDateTime=0x1d5edbd, ftLastWriteTime.dwLowDateTime=0x62fae325, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x4dd0)) returned 1 [0151.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea54) returned 1 [0151.409] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mp ek7d5ydej7.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\Mp EK7D5YDEj7.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\mp ek7d5ydej7.mkv.rogue")) returned 1 [0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x4e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", lpFilePart=0x0) returned 0x4d [0151.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9d8) returned 1 [0151.410] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\vzxuey.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.410] GetFileType (hFile=0x2cc) returned 0x1 [0151.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9d4) returned 1 [0151.410] GetFileType (hFile=0x2cc) returned 0x1 [0151.411] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8fead4 | out: lpFileSizeHigh=0x8fead4*=0x0) returned 0xe2a6 [0151.411] ReadFile (in: hFile=0x2cc, lpBuffer=0x2849a84, nNumberOfBytesToRead=0xe2a6, lpNumberOfBytesRead=0x8fea80, lpOverlapped=0x0 | out: lpBuffer=0x2849a84*, lpNumberOfBytesRead=0x8fea80*=0xe2a6, lpOverlapped=0x0) returned 1 [0151.412] CloseHandle (hObject=0x2cc) returned 1 [0151.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.502] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea4c) returned 1 [0151.502] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feac8 | out: lpFileInformation=0x8feac8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea48) returned 1 [0151.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0151.503] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x4e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", lpFilePart=0x0) returned 0x4d [0151.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fe9c4) returned 1 [0151.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\vzxuey.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.505] GetFileType (hFile=0x2cc) returned 0x1 [0151.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fe9c0) returned 1 [0151.505] GetFileType (hFile=0x2cc) returned 0x1 [0151.505] WriteFile (in: hFile=0x2cc, lpBuffer=0x28c1094*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x8fea74, lpOverlapped=0x0 | out: lpBuffer=0x28c1094*, lpNumberOfBytesWritten=0x8fea74*=0xe2b0, lpOverlapped=0x0) returned 1 [0151.508] CloseHandle (hObject=0x2cc) returned 1 [0151.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0151.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", nBufferLength=0x4e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4", lpFilePart=0x0) returned 0x4d [0151.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0151.512] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4.rogue", nBufferLength=0x54, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4.rogue", lpFilePart=0x0) returned 0x53 [0151.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea58) returned 1 [0151.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\vzxuey.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8fead4 | out: lpFileInformation=0x8fead4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74adc610, ftCreationTime.dwHighDateTime=0x1d5e397, ftLastAccessTime.dwLowDateTime=0x7224d1b0, ftLastAccessTime.dwHighDateTime=0x1d5e7ff, ftLastWriteTime.dwLowDateTime=0x6309329f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xe2b0)) returned 1 [0151.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea54) returned 1 [0151.512] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\vzxuey.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\IhxiISsMcq\\FnphE-atdZvFk3A75l\\VZXuey.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\ihxiissmcq\\fnphe-atdzvfk3a75l\\vzxuey.mp4.rogue")) returned 1 [0151.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0151.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0151.513] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", nBufferLength=0x3a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", lpFilePart=0x0) returned 0x39 [0151.513] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fca8 [0151.514] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.514] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f886810, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf65a390, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xf65a390, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0xa6e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="5dfYpdlGWfDNxLzNvzFD.mkv", cAlternateFileName="5DFYPD~1.MKV")) returned 1 [0151.514] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5067b4b0, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0x2b9fec80, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x2b9fec80, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0x8435, dwReserved0=0x0, dwReserved1=0x0, cFileName="O5Qcd1T1I EbI.mp4", cAlternateFileName="O5QCD1~1.MP4")) returned 1 [0151.514] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741c0080, ftCreationTime.dwHighDateTime=0x1d5e9f1, ftLastAccessTime.dwLowDateTime=0x980185b0, ftLastAccessTime.dwHighDateTime=0x1d5ee3d, ftLastWriteTime.dwLowDateTime=0x980185b0, ftLastWriteTime.dwHighDateTime=0x1d5ee3d, nFileSizeHigh=0x0, nFileSizeLow=0xac16, dwReserved0=0x0, dwReserved1=0x0, cFileName="OV3dTk.mkv", cAlternateFileName="")) returned 1 [0151.514] FindNextFileW (in: hFindFile=0x7a5fca8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0151.514] FindClose (in: hFindFile=0x7a5fca8 | out: hFindFile=0x7a5fca8) returned 1 [0151.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0151.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0151.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0151.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0151.515] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", nBufferLength=0x3a, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd", lpFilePart=0x0) returned 0x39 [0151.515] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fee8 [0151.515] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92e95eb0, ftCreationTime.dwHighDateTime=0x1d5ee36, ftLastAccessTime.dwLowDateTime=0x83ad4130, ftLastAccessTime.dwHighDateTime=0x1d5edde, ftLastWriteTime.dwLowDateTime=0x83ad4130, ftLastWriteTime.dwHighDateTime=0x1d5edde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.515] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f886810, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf65a390, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0xf65a390, ftLastWriteTime.dwHighDateTime=0x1d5e1e4, nFileSizeHigh=0x0, nFileSizeLow=0xa6e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="5dfYpdlGWfDNxLzNvzFD.mkv", cAlternateFileName="5DFYPD~1.MKV")) returned 1 [0151.515] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5067b4b0, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0x2b9fec80, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x2b9fec80, ftLastWriteTime.dwHighDateTime=0x1d5e826, nFileSizeHigh=0x0, nFileSizeLow=0x8435, dwReserved0=0x0, dwReserved1=0x0, cFileName="O5Qcd1T1I EbI.mp4", cAlternateFileName="O5QCD1~1.MP4")) returned 1 [0151.515] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741c0080, ftCreationTime.dwHighDateTime=0x1d5e9f1, ftLastAccessTime.dwLowDateTime=0x980185b0, ftLastAccessTime.dwHighDateTime=0x1d5ee3d, ftLastWriteTime.dwLowDateTime=0x980185b0, ftLastWriteTime.dwHighDateTime=0x1d5ee3d, nFileSizeHigh=0x0, nFileSizeLow=0xac16, dwReserved0=0x0, dwReserved1=0x0, cFileName="OV3dTk.mkv", cAlternateFileName="")) returned 1 [0151.516] FindNextFileW (in: hFindFile=0x7a5fee8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741c0080, ftCreationTime.dwHighDateTime=0x1d5e9f1, ftLastAccessTime.dwLowDateTime=0x980185b0, ftLastAccessTime.dwHighDateTime=0x1d5ee3d, ftLastWriteTime.dwLowDateTime=0x980185b0, ftLastWriteTime.dwHighDateTime=0x1d5ee3d, nFileSizeHigh=0x0, nFileSizeLow=0xac16, dwReserved0=0x0, dwReserved1=0x0, cFileName="OV3dTk.mkv", cAlternateFileName="")) returned 0 [0151.516] FindClose (in: hFindFile=0x7a5fee8 | out: hFindFile=0x7a5fee8) returned 1 [0151.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0151.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0151.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0151.516] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", lpFilePart=0x0) returned 0x52 [0151.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0151.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\5dfypdlgwfdnxlznvzfd.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.516] GetFileType (hFile=0x2cc) returned 0x1 [0151.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0151.516] GetFileType (hFile=0x2cc) returned 0x1 [0151.516] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0xa6e5 [0151.516] ReadFile (in: hFile=0x2cc, lpBuffer=0x28d0e94, nNumberOfBytesToRead=0xa6e5, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x28d0e94*, lpNumberOfBytesRead=0x8feaf8*=0xa6e5, lpOverlapped=0x0) returned 1 [0151.517] CloseHandle (hObject=0x2cc) returned 1 [0151.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.536] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0151.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0151.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0151.537] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", lpFilePart=0x0) returned 0x52 [0151.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0151.537] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\5dfypdlgwfdnxlznvzfd.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.538] GetFileType (hFile=0x2cc) returned 0x1 [0151.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0151.538] GetFileType (hFile=0x2cc) returned 0x1 [0151.538] WriteFile (in: hFile=0x2cc, lpBuffer=0x293d164*, nNumberOfBytesToWrite=0xa6f0, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x293d164*, lpNumberOfBytesWritten=0x8feaec*=0xa6f0, lpOverlapped=0x0) returned 1 [0151.540] CloseHandle (hObject=0x2cc) returned 1 [0151.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0151.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", nBufferLength=0x53, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv", lpFilePart=0x0) returned 0x52 [0151.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x59 [0151.599] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv.rogue", nBufferLength=0x59, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv.rogue", lpFilePart=0x0) returned 0x58 [0151.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0151.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\5dfypdlgwfdnxlznvzfd.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f886810, ftCreationTime.dwHighDateTime=0x1d5ede3, ftLastAccessTime.dwLowDateTime=0xf65a390, ftLastAccessTime.dwHighDateTime=0x1d5e1e4, ftLastWriteTime.dwLowDateTime=0x631780ba, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xa6f0)) returned 1 [0151.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0151.600] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\5dfypdlgwfdnxlznvzfd.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\5dfYpdlGWfDNxLzNvzFD.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\5dfypdlgwfdnxlznvzfd.mkv.rogue")) returned 1 [0151.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0151.601] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x4c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", lpFilePart=0x0) returned 0x4b [0151.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0151.601] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\o5qcd1t1i ebi.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.601] GetFileType (hFile=0x2cc) returned 0x1 [0151.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0151.601] GetFileType (hFile=0x2cc) returned 0x1 [0151.601] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x8435 [0151.601] ReadFile (in: hFile=0x2cc, lpBuffer=0x2947b20, nNumberOfBytesToRead=0x8435, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x2947b20*, lpNumberOfBytesRead=0x8feaf8*=0x8435, lpOverlapped=0x0) returned 1 [0151.603] CloseHandle (hObject=0x2cc) returned 1 [0151.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0151.630] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0151.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0151.631] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x4c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", lpFilePart=0x0) returned 0x4b [0151.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0151.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\o5qcd1t1i ebi.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.632] GetFileType (hFile=0x2cc) returned 0x1 [0151.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0151.633] GetFileType (hFile=0x2cc) returned 0x1 [0151.633] WriteFile (in: hFile=0x2cc, lpBuffer=0x29bde4c*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x29bde4c*, lpNumberOfBytesWritten=0x8feaec*=0x8440, lpOverlapped=0x0) returned 1 [0151.635] CloseHandle (hObject=0x2cc) returned 1 [0151.697] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0151.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", nBufferLength=0x4c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4", lpFilePart=0x0) returned 0x4b [0151.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x52 [0151.698] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4.rogue", nBufferLength=0x52, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4.rogue", lpFilePart=0x0) returned 0x51 [0151.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0151.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\o5qcd1t1i ebi.mp4"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5067b4b0, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0x2b9fec80, ftLastAccessTime.dwHighDateTime=0x1d5e826, ftLastWriteTime.dwLowDateTime=0x6325cee7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x8440)) returned 1 [0151.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0151.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\o5qcd1t1i ebi.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\O5Qcd1T1I EbI.mp4.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\o5qcd1t1i ebi.mp4.rogue")) returned 1 [0151.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0151.699] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x45, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", lpFilePart=0x0) returned 0x44 [0151.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0151.699] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\ov3dtk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.699] GetFileType (hFile=0x2cc) returned 0x1 [0151.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0151.699] GetFileType (hFile=0x2cc) returned 0x1 [0151.699] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0xac16 [0151.699] ReadFile (in: hFile=0x2cc, lpBuffer=0x29c652c, nNumberOfBytesToRead=0xac16, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x29c652c*, lpNumberOfBytesRead=0x8feaf8*=0xac16, lpOverlapped=0x0) returned 1 [0151.701] CloseHandle (hObject=0x2cc) returned 1 [0151.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0151.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0151.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0151.800] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x45, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", lpFilePart=0x0) returned 0x44 [0151.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0151.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\ov3dtk.mkv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.802] GetFileType (hFile=0x2cc) returned 0x1 [0151.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0151.802] GetFileType (hFile=0x2cc) returned 0x1 [0151.802] WriteFile (in: hFile=0x2cc, lpBuffer=0x2828d88*, nNumberOfBytesToWrite=0xac20, lpNumberOfBytesWritten=0x8feaec, lpOverlapped=0x0 | out: lpBuffer=0x2828d88*, lpNumberOfBytesWritten=0x8feaec*=0xac20, lpOverlapped=0x0) returned 1 [0151.804] CloseHandle (hObject=0x2cc) returned 1 [0151.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0151.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", nBufferLength=0x45, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv", lpFilePart=0x0) returned 0x44 [0151.808] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0151.809] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv.rogue", nBufferLength=0x4b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv.rogue", lpFilePart=0x0) returned 0x4a [0151.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0151.809] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\ov3dtk.mkv"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x741c0080, ftCreationTime.dwHighDateTime=0x1d5e9f1, ftLastAccessTime.dwLowDateTime=0x980185b0, ftLastAccessTime.dwHighDateTime=0x1d5ee3d, ftLastWriteTime.dwLowDateTime=0x6336a7d7, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0xac20)) returned 1 [0151.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0151.809] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\ov3dtk.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\o2YBowEXKT9OUSbWjZUd\\OV3dTk.mkv.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\o2ybowexkt9ousbwjzud\\ov3dtk.mkv.rogue")) returned 1 [0151.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0151.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0151.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", lpFilePart=0x0) returned 0x2b [0151.810] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fd28 [0151.810] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.810] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0f8e40, ftCreationTime.dwHighDateTime=0x1d5e902, ftLastAccessTime.dwLowDateTime=0x5b625e90, ftLastAccessTime.dwHighDateTime=0x1d5e63b, ftLastWriteTime.dwLowDateTime=0x5b625e90, ftLastWriteTime.dwHighDateTime=0x1d5e63b, nFileSizeHigh=0x0, nFileSizeLow=0x13150, dwReserved0=0x0, dwReserved1=0x0, cFileName="4XTJkP.flv", cAlternateFileName="")) returned 1 [0151.810] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94b1870, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0x144c4d60, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x144c4d60, ftLastWriteTime.dwHighDateTime=0x1d5e427, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="OkvGBil.avi", cAlternateFileName="")) returned 1 [0151.810] FindNextFileW (in: hFindFile=0x7a5fd28, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0151.811] FindClose (in: hFindFile=0x7a5fd28 | out: hFindFile=0x7a5fd28) returned 1 [0151.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0151.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0151.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feba8) returned 1 [0151.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0151.811] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", nBufferLength=0x2c, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R", lpFilePart=0x0) returned 0x2b [0151.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\*", lpFindFileData=0x8fe8d0 | out: lpFindFileData=0x8fe8d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7a5fde8 [0151.811] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9a6c30, ftCreationTime.dwHighDateTime=0x1d5ee35, ftLastAccessTime.dwLowDateTime=0x99758e00, ftLastAccessTime.dwHighDateTime=0x1d5e76c, ftLastWriteTime.dwLowDateTime=0x99758e00, ftLastWriteTime.dwHighDateTime=0x1d5e76c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.811] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e0f8e40, ftCreationTime.dwHighDateTime=0x1d5e902, ftLastAccessTime.dwLowDateTime=0x5b625e90, ftLastAccessTime.dwHighDateTime=0x1d5e63b, ftLastWriteTime.dwLowDateTime=0x5b625e90, ftLastWriteTime.dwHighDateTime=0x1d5e63b, nFileSizeHigh=0x0, nFileSizeLow=0x13150, dwReserved0=0x0, dwReserved1=0x0, cFileName="4XTJkP.flv", cAlternateFileName="")) returned 1 [0151.812] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94b1870, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0x144c4d60, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x144c4d60, ftLastWriteTime.dwHighDateTime=0x1d5e427, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="OkvGBil.avi", cAlternateFileName="")) returned 1 [0151.812] FindNextFileW (in: hFindFile=0x7a5fde8, lpFindFileData=0x8fe8dc | out: lpFindFileData=0x8fe8dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94b1870, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0x144c4d60, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x144c4d60, ftLastWriteTime.dwHighDateTime=0x1d5e427, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="OkvGBil.avi", cAlternateFileName="")) returned 0 [0151.812] FindClose (in: hFindFile=0x7a5fde8 | out: hFindFile=0x7a5fde8) returned 1 [0151.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb64) returned 1 [0151.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feb70) returned 1 [0151.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0151.812] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", lpFilePart=0x0) returned 0x37 [0151.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea50) returned 1 [0151.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\znfo1r\\okvgbil.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.813] GetFileType (hFile=0x2cc) returned 0x1 [0151.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea4c) returned 1 [0151.813] GetFileType (hFile=0x2cc) returned 0x1 [0151.813] GetFileSize (in: hFile=0x2cc, lpFileSizeHigh=0x8feb4c | out: lpFileSizeHigh=0x8feb4c*=0x0) returned 0x616 [0151.813] ReadFile (in: hFile=0x2cc, lpBuffer=0x2835390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8feaf8, lpOverlapped=0x0 | out: lpBuffer=0x2835390*, lpNumberOfBytesRead=0x8feaf8*=0x616, lpOverlapped=0x0) returned 1 [0151.814] CloseHandle (hObject=0x2cc) returned 1 [0151.909] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0151.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", nBufferLength=0x2b, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked", lpFilePart=0x0) returned 0x2a [0151.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feac4) returned 1 [0151.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt.locked" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt.locked"), fInfoLevelId=0x0, lpFileInformation=0x8feb40 | out: lpFileInformation=0x8feb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0151.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feac0) returned 1 [0151.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0151.910] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", lpFilePart=0x0) returned 0x37 [0151.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fea3c) returned 1 [0151.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\znfo1r\\okvgbil.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2cc [0151.930] GetFileType (hFile=0x2cc) returned 0x1 [0151.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fea38) returned 1 [0151.930] GetFileType (hFile=0x2cc) returned 0x1 [0151.930] WriteFile (in: hFile=0x2cc, lpBuffer=0x28852cc*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x8feac0, lpOverlapped=0x0 | out: lpBuffer=0x28852cc*, lpNumberOfBytesWritten=0x8feac0*=0x620, lpOverlapped=0x0) returned 1 [0151.931] CloseHandle (hObject=0x2cc) returned 1 [0151.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0151.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", nBufferLength=0x38, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi", lpFilePart=0x0) returned 0x37 [0151.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi.rogue", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0151.989] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi.rogue", nBufferLength=0x3e, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi.rogue", lpFilePart=0x0) returned 0x3d [0151.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fead0) returned 1 [0151.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\znfo1r\\okvgbil.avi"), fInfoLevelId=0x0, lpFileInformation=0x8feb4c | out: lpFileInformation=0x8feb4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb94b1870, ftCreationTime.dwHighDateTime=0x1d5e803, ftLastAccessTime.dwLowDateTime=0x144c4d60, ftLastAccessTime.dwHighDateTime=0x1d5e427, ftLastWriteTime.dwLowDateTime=0x63531b1f, ftLastWriteTime.dwHighDateTime=0x1d61763, nFileSizeHigh=0x0, nFileSizeLow=0x620)) returned 1 [0151.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feacc) returned 1 [0151.989] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\znfo1r\\okvgbil.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lyBQb7\\sP-6fa\\zNFo1R\\OkvGBil.avi.rogue" (normalized: "c:\\users\\fd1hvy\\videos\\lybqb7\\sp-6fa\\znfo1r\\okvgbil.avi.rogue")) returned 1 [0152.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0152.005] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt", nBufferLength=0x24, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt", lpFilePart=0x0) returned 0x23 [0152.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fecb4) returned 1 [0152.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\READ_IT.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\read_it.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2cc [0152.080] GetFileType (hFile=0x2cc) returned 0x1 [0152.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fecb0) returned 1 [0152.080] GetFileType (hFile=0x2cc) returned 0x1 [0152.082] WriteFile (in: hFile=0x2cc, lpBuffer=0x2888418*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x8fed14, lpOverlapped=0x0 | out: lpBuffer=0x2888418*, lpNumberOfBytesWritten=0x8fed14*=0x104, lpOverlapped=0x0) returned 1 [0152.083] CloseHandle (hObject=0x2cc) returned 1 [0159.946] GetCurrentProcess () returned 0xffffffff [0159.946] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea04 | out: TokenHandle=0x8fea04*=0x2e8) returned 1 [0159.961] GetCurrentProcess () returned 0xffffffff [0159.961] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea14 | out: TokenHandle=0x8fea14*=0x2ec) returned 1 [0160.328] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2d0 [0160.329] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2d4 [0160.536] GetCurrentProcess () returned 0xffffffff [0160.536] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea24 | out: TokenHandle=0x8fea24*=0x2f0) returned 1 [0160.540] GetCurrentProcess () returned 0xffffffff [0160.540] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea34 | out: TokenHandle=0x8fea34*=0x2d8) returned 1 [0160.593] QueryPerformanceFrequency (in: lpFrequency=0xde5ab0 | out: lpFrequency=0xde5ab0*=100000000) returned 1 [0160.593] QueryPerformanceCounter (in: lpPerformanceCount=0x8feda8 | out: lpPerformanceCount=0x8feda8*=25561247914) returned 1 [0160.598] GetCurrentProcess () returned 0xffffffff [0160.599] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9f0 | out: TokenHandle=0x8fe9f0*=0x2dc) returned 1 [0160.606] GetCurrentProcess () returned 0xffffffff [0160.606] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea00 | out: TokenHandle=0x8fea00*=0x40c) returned 1 [0161.078] GetCurrentProcess () returned 0xffffffff [0161.078] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea04 | out: TokenHandle=0x8fea04*=0x41c) returned 1 [0161.081] GetCurrentProcess () returned 0xffffffff [0161.081] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fea14 | out: TokenHandle=0x8fea14*=0x420) returned 1 [0161.085] GetCurrentProcess () returned 0xffffffff [0161.085] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec8c | out: TokenHandle=0x8fec8c*=0x424) returned 1 [0161.090] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fddc4 | out: phkResult=0x8fddc4*=0x428) returned 0x0 [0161.092] RegQueryValueExW (in: hKey=0x428, lpValueName="InstallationType", lpReserved=0x0, lpType=0x8fdde4, lpData=0x0, lpcbData=0x8fdde0*=0x0 | out: lpType=0x8fdde4*=0x1, lpData=0x0, lpcbData=0x8fdde0*=0xe) returned 0x0 [0161.093] RegQueryValueExW (in: hKey=0x428, lpValueName="InstallationType", lpReserved=0x0, lpType=0x8fdde4, lpData=0x2893634, lpcbData=0x8fdde0*=0xe | out: lpType=0x8fdde4*=0x1, lpData="Client", lpcbData=0x8fdde0*=0xe) returned 0x0 [0161.093] RegCloseKey (hKey=0x428) returned 0x0 [0162.004] CoTaskMemAlloc (cb=0xcc0) returned 0xa1cd00 [0162.007] RasEnumConnectionsW (in: param_1=0xa1cd00, param_2=0x8fec9c, param_3=0x8feca0 | out: param_1=0xa1cd00, param_2=0x8fec9c, param_3=0x8feca0) returned 0x0 [0162.187] CoTaskMemFree (pv=0xa1cd00) [0162.321] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x8fea88 | out: lpWSAData=0x8fea88) returned 0 [0162.329] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x48c [0162.350] setsockopt (s=0x48c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0162.351] closesocket (s=0x48c) returned 0 [0162.486] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x48c [0162.492] setsockopt (s=0x48c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0162.492] closesocket (s=0x48c) returned 0 [0162.493] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x48c [0162.493] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x490 [0162.494] ioctlsocket (in: s=0x48c, cmd=-2147195266, argp=0x8feca4 | out: argp=0x8feca4) returned 0 [0162.494] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x494 [0162.494] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x498 [0162.494] ioctlsocket (in: s=0x494, cmd=-2147195266, argp=0x8feca4 | out: argp=0x8feca4) returned 0 [0162.495] WSAIoctl (in: s=0x48c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8fec8c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8fec8c, lpOverlapped=0x0) returned -1 [0162.498] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x8fe9bc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.503] WSAEventSelect (s=0x48c, hEventObject=0x490, lNetworkEvents=512) returned 0 [0162.504] WSAIoctl (in: s=0x494, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8fec8c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8fec8c, lpOverlapped=0x0) returned -1 [0162.504] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x8fe9bc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0162.504] WSAEventSelect (s=0x494, hEventObject=0x498, lNetworkEvents=512) returned 0 [0162.505] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4a0 [0162.505] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x4a0, param_3=0x3) returned 0x0 [0163.598] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x8fecb8 | out: phkResult=0x8fecb8*=0x4b8) returned 0x0 [0163.600] RegOpenKeyExW (in: hKey=0x4b8, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fec6c | out: phkResult=0x8fec6c*=0x4bc) returned 0x0 [0163.601] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c0 [0163.602] RegNotifyChangeKeyValue (hKey=0x4bc, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c0, fAsynchronous=1) returned 0x0 [0163.603] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fec70 | out: phkResult=0x8fec70*=0x4c4) returned 0x0 [0163.604] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c8 [0163.604] RegNotifyChangeKeyValue (hKey=0x4c4, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c8, fAsynchronous=1) returned 0x0 [0163.604] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fec70 | out: phkResult=0x8fec70*=0x4cc) returned 0x0 [0163.605] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d0 [0163.605] RegNotifyChangeKeyValue (hKey=0x4cc, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4d0, fAsynchronous=1) returned 0x0 [0163.606] GetCurrentProcess () returned 0xffffffff [0163.606] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fec5c | out: TokenHandle=0x8fec5c*=0x4d4) returned 1 [0163.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe568 | out: phkResult=0x8fe568*=0x4d8) returned 0x0 [0163.613] RegQueryValueExW (in: hKey=0x4d8, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x8fe584, lpData=0x0, lpcbData=0x8fe580*=0x0 | out: lpType=0x8fe584*=0x0, lpData=0x0, lpcbData=0x8fe580*=0x0) returned 0x2 [0163.614] RegCloseKey (hKey=0x4d8) returned 0x0 [0163.643] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0xa23fb8 [0163.937] WinHttpSetTimeouts (hInternet=0xa23fb8, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0163.938] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x8fec6c | out: pProxyConfig=0x8fec6c) returned 1 [0164.149] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x8fe4e0, nSize=0x80 | out: lpBuffer="ﾉ琉￿￿\x8fဢ玳㦀牴皴犭佚玼묨渰\x9c皴犭㦀牴胰犘㦀牴胰犘\x8f啾玼￿￿\x8f꛰琉￿￿佚玼刐玼䪌犷") returned 0x0 [0164.149] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x8fe4e0, nSize=0x80 | out: lpBuffer="ﾉ琉￿￿\x8fဢ玳㦀牴皴犭佚玼묨渰\x9c皴犭㦀牴胰犘㦀牴胰犘\x8f啾玼￿￿\x8f꛰琉￿￿佚玼刐玼䪌犷") returned 0x0 [0164.154] EtwEventRegister (in: ProviderId=0x28962dc, EnableCallback=0x4d43836, CallbackContext=0x0, RegHandle=0x28962b8 | out: RegHandle=0x28962b8) returned 0x0 [0164.155] EtwEventSetInformation (RegHandle=0xa056a0, InformationClass=0x65, EventInformation=0x2, InformationLength=0x2896278) returned 0x0 [0164.158] GetCurrentProcess () returned 0xffffffff [0164.158] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9cc | out: TokenHandle=0x8fe9cc*=0x518) returned 1 [0164.160] GetCurrentProcess () returned 0xffffffff [0164.160] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe9dc | out: TokenHandle=0x8fe9dc*=0x51c) returned 1 [0164.164] SetEvent (hEvent=0x2d0) returned 1 [0164.270] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febd4*=0x4a0, lpdwindex=0x8fe9f4 | out: lpdwindex=0x8fe9f4) returned 0x80010115 [0165.074] BeginPaint (in: hWnd=0x8005c, lpPaint=0x8fe338 | out: lpPaint=0x8fe338) returned 0x10105d6 [0165.076] GdipCreateHalftonePalette () returned 0x47080787 [0165.077] SelectPalette (hdc=0x10105d6, hPal=0x47080787, bForceBkgd=1) returned 0x88000b [0165.078] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0165.078] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0165.078] GetSystemMetrics (nIndex=42) returned 0 [0165.078] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe2d0, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0165.078] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe2d0) returned 0x7 [0165.078] SelectPalette (hdc=0x10105d6, hPal=0x88000b, bForceBkgd=0) returned 0x47080787 [0165.079] EndPaint (hWnd=0x8005c, lpPaint=0x8fe334) returned 1 [0165.080] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb4*=0x490, lpdwindex=0x8fe9d4 | out: lpdwindex=0x8fe9d4) returned 0x80010115 [0165.081] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb4*=0x498, lpdwindex=0x8fe9d4 | out: lpdwindex=0x8fe9d4) returned 0x80010115 [0165.081] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8fec08*=0x4c0, lpdwindex=0x8fea24 | out: lpdwindex=0x8fea24) returned 0x80010115 [0165.082] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8fec08*=0x4c8, lpdwindex=0x8fea24 | out: lpdwindex=0x8fea24) returned 0x80010115 [0165.082] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8fec08*=0x4d0, lpdwindex=0x8fea24 | out: lpdwindex=0x8fea24) returned 0x80010115 [0165.776] GetCurrentProcess () returned 0xffffffff [0165.776] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe944 | out: TokenHandle=0x8fe944*=0x558) returned 1 [0165.777] GetCurrentProcess () returned 0xffffffff [0165.777] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe954 | out: TokenHandle=0x8fe954*=0x55c) returned 1 [0165.779] GetTimeZoneInformation (in: lpTimeZoneInformation=0x8feac4 | out: lpTimeZoneInformation=0x8feac4) returned 0x2 [0165.799] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x8fe920 | out: pTimeZoneInformation=0x8fe920) returned 0x2 [0165.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea04 | out: phkResult=0x8fea04*=0x560) returned 0x0 [0165.802] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0x8fea20, lpData=0x0, lpcbData=0x8fea1c*=0x0 | out: lpType=0x8fea20*=0x3, lpData=0x0, lpcbData=0x8fea1c*=0x2c) returned 0x0 [0165.802] RegQueryValueExW (in: hKey=0x560, lpValueName="TZI", lpReserved=0x0, lpType=0x8fea20, lpData=0x28993a4, lpcbData=0x8fea1c*=0x2c | out: lpType=0x8fea20*=0x3, lpData=0x28993a4*, lpcbData=0x8fea1c*=0x2c) returned 0x0 [0165.802] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fe858 | out: phkResult=0x8fe858*=0x0) returned 0x2 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x0, lpcbData=0x8fe9f4*=0x0 | out: lpType=0x8fe9f8*=0x1, lpData=0x0, lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x28997c8, lpcbData=0x8fe9f4*=0x20 | out: lpType=0x8fe9f8*=0x1, lpData="@tzres.dll,-320", lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x0, lpcbData=0x8fe9f4*=0x0 | out: lpType=0x8fe9f8*=0x1, lpData=0x0, lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x2899820, lpcbData=0x8fe9f4*=0x20 | out: lpType=0x8fe9f8*=0x1, lpData="@tzres.dll,-322", lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x0, lpcbData=0x8fe9f4*=0x0 | out: lpType=0x8fe9f8*=0x1, lpData=0x0, lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.804] RegQueryValueExW (in: hKey=0x560, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x8fe9f8, lpData=0x2899878, lpcbData=0x8fe9f4*=0x20 | out: lpType=0x8fe9f8*=0x1, lpData="@tzres.dll,-321", lpcbData=0x8fe9f4*=0x20) returned 0x0 [0165.812] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.812] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa29bd8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0165.816] CoTaskMemFree (pv=0xa29bd8) [0165.816] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.816] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath=0xa29bd8, pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c | out: pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c) returned 1 [0165.934] CoTaskMemFree (pv=0x0) [0165.934] CoTaskMemFree (pv=0xa29bd8) [0165.935] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8140001 [0165.938] CoTaskMemAlloc (cb=0x3ec) returned 0xa2a6b0 [0165.938] LoadStringW (in: hInstance=0x8140001, uID=0x140, lpBuffer=0xa2a6b0, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0165.938] CoTaskMemFree (pv=0xa2a6b0) [0165.938] FreeLibrary (hLibModule=0x8140001) returned 1 [0165.940] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.940] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa29bd8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0165.940] CoTaskMemFree (pv=0xa29bd8) [0165.940] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.940] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath=0xa29bd8, pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c | out: pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c) returned 1 [0165.940] CoTaskMemFree (pv=0x0) [0165.940] CoTaskMemFree (pv=0xa29bd8) [0165.940] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8140001 [0165.941] CoTaskMemAlloc (cb=0x3ec) returned 0xa2a6b0 [0165.941] LoadStringW (in: hInstance=0x8140001, uID=0x142, lpBuffer=0xa2a6b0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0165.943] CoTaskMemFree (pv=0xa2a6b0) [0165.943] FreeLibrary (hLibModule=0x8140001) returned 1 [0165.943] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.943] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0xa29bd8 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0165.943] CoTaskMemFree (pv=0xa29bd8) [0165.943] CoTaskMemAlloc (cb=0x20c) returned 0xa29bd8 [0165.943] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath=0xa29bd8, pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c | out: pwszLanguage=0x0, pcchLanguage=0x8fea14, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x8fea18, pululEnumerator=0x8fea0c) returned 1 [0165.944] CoTaskMemFree (pv=0x0) [0165.944] CoTaskMemFree (pv=0xa29bd8) [0165.944] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x8140001 [0165.946] CoTaskMemAlloc (cb=0x3ec) returned 0xa2a6b0 [0165.946] LoadStringW (in: hInstance=0x8140001, uID=0x141, lpBuffer=0xa2a6b0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0165.946] CoTaskMemFree (pv=0xa2a6b0) [0165.946] FreeLibrary (hLibModule=0x8140001) returned 1 [0165.947] RegCloseKey (hKey=0x560) returned 0x0 [0165.947] SetEvent (hEvent=0x2d0) returned 1 [0166.075] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x8fec20 | out: pFixedInfo=0x0, pOutBufLen=0x8fec20) returned 0x6f [0167.331] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0xa29bd8 [0167.331] GetNetworkParams (in: pFixedInfo=0xa29bd8, pOutBufLen=0x8fec20 | out: pFixedInfo=0xa29bd8, pOutBufLen=0x8fec20) returned 0x0 [0167.581] LocalFree (hMem=0xa29bd8) returned 0x0 [0167.582] CoTaskMemAlloc (cb=0x20c) returned 0xa2dff0 [0167.582] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0xa2dff0, nSize=0x104 | out: lpBuffer="鯘¢컀¢") returned 0x0 [0167.582] CoTaskMemFree (pv=0xa2dff0) [0167.582] CoTaskMemAlloc (cb=0x20c) returned 0xa2dff0 [0167.582] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0xa2dff0, nSize=0x104 | out: lpBuffer="鯘¢컀¢") returned 0x0 [0167.582] CoTaskMemFree (pv=0xa2dff0) [0167.586] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5a0 [0167.654] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x578 [0167.655] GetAddrInfoW (in: pNodeName="www.google.com", pServiceName=0x0, pHints=0x8feb08*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x8feab0 | out: ppResult=0x8feab0*=0xa18430*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0xa384b8*(sa_family=2, sin_port=0x0, sin_addr="172.217.21.196"), ai_next=0x0)) returned 0 [0167.908] FreeAddrInfoW (pAddrInfo=0xa18430*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="www.google.com", ai_addr=0xa384b8*(sa_family=2, sin_port=0x0, sin_addr="172.217.21.196"), ai_next=0x0)) [0167.952] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5a8 [0167.952] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5b4 [0167.952] ioctlsocket (in: s=0x5a8, cmd=-2147195266, argp=0x8feadc | out: argp=0x8feadc) returned 0 [0167.952] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5b8 [0167.952] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5bc [0167.952] ioctlsocket (in: s=0x5b8, cmd=-2147195266, argp=0x8feadc | out: argp=0x8feadc) returned 0 [0167.952] WSAIoctl (in: s=0x5a8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8feac4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8feac4, lpOverlapped=0x0) returned -1 [0167.953] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x8fe7f4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0167.953] WSAEventSelect (s=0x5a8, hEventObject=0x5b4, lNetworkEvents=512) returned 0 [0167.953] WSAIoctl (in: s=0x5b8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8feac4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8feac4, lpOverlapped=0x0) returned -1 [0167.953] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x8fe7f4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0167.953] WSAEventSelect (s=0x5b8, hEventObject=0x5bc, lNetworkEvents=512) returned 0 [0167.954] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x8feac0*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x8feac0*=0x818) returned 0x6f [0167.963] LocalAlloc (uFlags=0x0, uBytes=0x818) returned 0xa417f0 [0167.963] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0xa417f0, SizePointer=0x8feac0*=0x818 | out: AdapterAddresses=0xa417f0*(Alignment=0x300000178, Length=0x178, IfIndex=0x3, Next=0xa41aa0, AdapterName="{9E48833B-70C6-43EE-85DC-893C1782D802}", FirstUnicastAddress=0xa41a14, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x25, [2]=0x2a, [3]=0xb1, [4]=0x8c, [5]=0xfa, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x3, ZoneIndices=([0]=0x3, [1]=0x3, [2]=0x3, [3]=0x3, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x19, Ipv6Metric=0x19, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0xa41968*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11e7933cfae992b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x23, [5]=0x7d, [6]=0xeb, [7]=0x9, [8]=0x7c, [9]=0x4a, [10]=0x82, [11]=0x56, [12]=0xb9, [13]=0x2b, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x57c4a82, FirstDnsSuffix=0x0), SizePointer=0x8feac0*=0x818) returned 0x0 [0167.975] LocalFree (hMem=0xa417f0) returned 0x0 [0168.012] WSAConnect (in: s=0x5a0, name=0x28a545c*(sa_family=2, sin_port=0x1bb, sin_addr="172.217.21.196"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0168.038] closesocket (s=0x578) returned 0 [0168.058] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea10 | out: phkResult=0x8fea10*=0x578) returned 0x0 [0168.060] RegQueryValueExW (in: hKey=0x578, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x8fea2c, lpData=0x0, lpcbData=0x8fea28*=0x0 | out: lpType=0x8fea2c*=0x0, lpData=0x0, lpcbData=0x8fea28*=0x0) returned 0x2 [0168.060] RegCloseKey (hKey=0x578) returned 0x0 [0168.073] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea14 | out: phkResult=0x8fea14*=0x578) returned 0x0 [0168.074] RegQueryValueExW (in: hKey=0x578, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x8fea30, lpData=0x0, lpcbData=0x8fea2c*=0x0 | out: lpType=0x8fea30*=0x0, lpData=0x0, lpcbData=0x8fea2c*=0x0) returned 0x2 [0168.074] RegCloseKey (hKey=0x578) returned 0x0 [0168.076] GetCurrentProcessId () returned 0xd04 [0168.079] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0x578 [0168.090] EnumProcessModules (in: hProcess=0x578, lphModule=0x28a7a00, cb=0x100, lpcbNeeded=0x8fea1c | out: lphModule=0x28a7a00, lpcbNeeded=0x8fea1c) returned 1 [0168.090] EnumProcessModules (in: hProcess=0x578, lphModule=0x28a7b0c, cb=0x200, lpcbNeeded=0x8fea1c | out: lphModule=0x28a7b0c, lpcbNeeded=0x8fea1c) returned 1 [0168.090] GetModuleInformation (in: hProcess=0x578, hModule=0x4f0000, lpmodinfo=0x28a7d4c, cb=0xc | out: lpmodinfo=0x28a7d4c*(lpBaseOfDll=0x4f0000, SizeOfImage=0x14000, EntryPoint=0x0)) returned 1 [0168.091] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.091] GetModuleBaseNameW (in: hProcess=0x578, hModule=0x4f0000, lpBaseName=0xa417f0, nSize=0x800 | out: lpBaseName="compito italiano.doc.exe") returned 0x18 [0168.091] CoTaskMemFree (pv=0xa417f0) [0168.092] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.092] GetModuleFileNameExW (in: hProcess=0x578, hModule=0x4f0000, lpFilename=0xa417f0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe")) returned 0x30 [0168.092] CoTaskMemFree (pv=0xa417f0) [0168.092] CloseHandle (hObject=0x578) returned 1 [0168.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0168.094] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0168.095] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea14 | out: phkResult=0x8fea14*=0x0) returned 0x2 [0168.096] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea14 | out: phkResult=0x8fea14*=0x578) returned 0x0 [0168.097] RegQueryValueExW (in: hKey=0x578, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x8fea30, lpData=0x0, lpcbData=0x8fea2c*=0x0 | out: lpType=0x8fea30*=0x0, lpData=0x0, lpcbData=0x8fea2c*=0x0) returned 0x2 [0168.097] RegCloseKey (hKey=0x578) returned 0x0 [0168.098] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea14 | out: phkResult=0x8fea14*=0x578) returned 0x0 [0168.099] RegQueryValueExW (in: hKey=0x578, lpValueName="SystemDefaultTlsVersions", lpReserved=0x0, lpType=0x8fea30, lpData=0x0, lpcbData=0x8fea2c*=0x0 | out: lpType=0x8fea30*=0x0, lpData=0x0, lpcbData=0x8fea2c*=0x0) returned 0x2 [0168.099] RegCloseKey (hKey=0x578) returned 0x0 [0168.099] GetCurrentProcessId () returned 0xd04 [0168.099] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0x578 [0168.099] EnumProcessModules (in: hProcess=0x578, lphModule=0x28aa868, cb=0x100, lpcbNeeded=0x8fea1c | out: lphModule=0x28aa868, lpcbNeeded=0x8fea1c) returned 1 [0168.099] EnumProcessModules (in: hProcess=0x578, lphModule=0x28aa974, cb=0x200, lpcbNeeded=0x8fea1c | out: lphModule=0x28aa974, lpcbNeeded=0x8fea1c) returned 1 [0168.100] GetModuleInformation (in: hProcess=0x578, hModule=0x4f0000, lpmodinfo=0x28aabb4, cb=0xc | out: lpmodinfo=0x28aabb4*(lpBaseOfDll=0x4f0000, SizeOfImage=0x14000, EntryPoint=0x0)) returned 1 [0168.100] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.100] GetModuleBaseNameW (in: hProcess=0x578, hModule=0x4f0000, lpBaseName=0xa417f0, nSize=0x800 | out: lpBaseName="compito italiano.doc.exe") returned 0x18 [0168.100] CoTaskMemFree (pv=0xa417f0) [0168.100] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.100] GetModuleFileNameExW (in: hProcess=0x578, hModule=0x4f0000, lpFilename=0xa417f0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe")) returned 0x30 [0168.100] CoTaskMemFree (pv=0xa417f0) [0168.100] CloseHandle (hObject=0x578) returned 1 [0168.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0168.100] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0168.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SystemDefaultTlsVersions", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea14 | out: phkResult=0x8fea14*=0x0) returned 0x2 [0168.108] GetCurrentProcessId () returned 0xd04 [0168.108] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0x578 [0168.108] EnumProcessModules (in: hProcess=0x578, lphModule=0x28ad284, cb=0x100, lpcbNeeded=0x8fea14 | out: lphModule=0x28ad284, lpcbNeeded=0x8fea14) returned 1 [0168.109] EnumProcessModules (in: hProcess=0x578, lphModule=0x28ad390, cb=0x200, lpcbNeeded=0x8fea14 | out: lphModule=0x28ad390, lpcbNeeded=0x8fea14) returned 1 [0168.109] GetModuleInformation (in: hProcess=0x578, hModule=0x4f0000, lpmodinfo=0x28ad5d0, cb=0xc | out: lpmodinfo=0x28ad5d0*(lpBaseOfDll=0x4f0000, SizeOfImage=0x14000, EntryPoint=0x0)) returned 1 [0168.109] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.109] GetModuleBaseNameW (in: hProcess=0x578, hModule=0x4f0000, lpBaseName=0xa417f0, nSize=0x800 | out: lpBaseName="compito italiano.doc.exe") returned 0x18 [0168.109] CoTaskMemFree (pv=0xa417f0) [0168.109] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.109] GetModuleFileNameExW (in: hProcess=0x578, hModule=0x4f0000, lpFilename=0xa417f0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe")) returned 0x30 [0168.110] CoTaskMemFree (pv=0xa417f0) [0168.110] CloseHandle (hObject=0x578) returned 1 [0168.110] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0168.110] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0168.110] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.RequireCertificateEKUs", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea0c | out: phkResult=0x8fea0c*=0x0) returned 0x2 [0168.111] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea0c | out: phkResult=0x8fea0c*=0x578) returned 0x0 [0168.112] RegQueryValueExW (in: hKey=0x578, lpValueName="RequireCertificateEKUs", lpReserved=0x0, lpType=0x8fea28, lpData=0x0, lpcbData=0x8fea24*=0x0 | out: lpType=0x8fea28*=0x0, lpData=0x0, lpcbData=0x8fea24*=0x0) returned 0x2 [0168.112] RegCloseKey (hKey=0x578) returned 0x0 [0168.124] GetCurrentProcessId () returned 0xd04 [0168.124] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd04) returned 0x578 [0168.124] EnumProcessModules (in: hProcess=0x578, lphModule=0x28afe34, cb=0x100, lpcbNeeded=0x8fea18 | out: lphModule=0x28afe34, lpcbNeeded=0x8fea18) returned 1 [0168.124] EnumProcessModules (in: hProcess=0x578, lphModule=0x28aff40, cb=0x200, lpcbNeeded=0x8fea18 | out: lphModule=0x28aff40, lpcbNeeded=0x8fea18) returned 1 [0168.124] GetModuleInformation (in: hProcess=0x578, hModule=0x4f0000, lpmodinfo=0x28b0180, cb=0xc | out: lpmodinfo=0x28b0180*(lpBaseOfDll=0x4f0000, SizeOfImage=0x14000, EntryPoint=0x0)) returned 1 [0168.125] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.125] GetModuleBaseNameW (in: hProcess=0x578, hModule=0x4f0000, lpBaseName=0xa417f0, nSize=0x800 | out: lpBaseName="compito italiano.doc.exe") returned 0x18 [0168.125] CoTaskMemFree (pv=0xa417f0) [0168.125] CoTaskMemAlloc (cb=0x804) returned 0xa417f0 [0168.125] GetModuleFileNameExW (in: hProcess=0x578, hModule=0x4f0000, lpFilename=0xa417f0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe")) returned 0x30 [0168.125] CoTaskMemFree (pv=0xa417f0) [0168.125] CloseHandle (hObject=0x578) returned 1 [0168.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0168.125] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0168.126] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x8fea10 | out: phkResult=0x8fea10*=0x0) returned 0x2 [0168.134] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x9f2100 [0168.606] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0x9f2100, dwGroupId=0x0) returned 0x0 [0168.660] LocalFree (hMem=0x9f2100) returned 0x0 [0168.661] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0xa47e48 [0168.661] CryptFindOIDInfo (dwKeyType=0x2, pvKey=0xa47e48, dwGroupId=0x0) returned 0x0 [0168.662] LocalFree (hMem=0xa47e48) returned 0x0 [0168.767] EnumerateSecurityPackagesW (in: pcPackages=0x8fea50, ppPackageInfo=0x8fe9e4 | out: pcPackages=0x8fea50, ppPackageInfo=0x8fe9e4) returned 0x0 [0168.799] FreeContextBuffer (in: pvContextBuffer=0xa2fe38 | out: pvContextBuffer=0xa2fe38) returned 0x0 [0168.807] GetCurrentProcess () returned 0xffffffff [0168.807] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8fe814 | out: TokenHandle=0x8fe814*=0x5c8) returned 1 [0168.809] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x28b253c, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x8fe868, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x28b3ce8, ptsExpiry=0x8fe7ec | out: phCredential=0x28b3ce8, ptsExpiry=0x8fe7ec) returned 0x0 [0168.877] InitializeSecurityContextW (in: phCredential=0x8fe828, phContext=0x0, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b3e84, pfContextAttr=0x28b2510, ptsExpiry=0x8fe820 | out: phNewContext=0x28b3eec, pOutput=0x28b3e84, pfContextAttr=0x28b2510, ptsExpiry=0x8fe820) returned 0x90312 [0168.894] FreeContextBuffer (in: pvContextBuffer=0xa2e168 | out: pvContextBuffer=0xa2e168) returned 0x0 [0168.898] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0168.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x8fe868, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatãâq'û\x0eãðù°s¸ï\x8f", lpUsedDefaultChar=0x0) returned 21 [0168.899] GetProcAddress (hModule=0x772d0000, lpProcName="AppPolicyGetClrCompat") returned 0x74c968b0 [0168.907] AppPolicyGetClrCompat () returned 0x0 [0168.909] send (s=0x5a0, buf=0x28b3f00*, len=174, flags=0) returned 174 [0168.929] recv (in: s=0x5a0, buf=0x28b3f00, len=5, flags=0 | out: buf=0x28b3f00*) returned 5 [0168.967] recv (in: s=0x5a0, buf=0x28b3f05, len=63, flags=0 | out: buf=0x28b3f05*) returned 63 [0168.968] InitializeSecurityContextW (in: phCredential=0x8fe780, phContext=0x8fe810, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b430c, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b4320, pfContextAttr=0x28b2510, ptsExpiry=0x8fe778 | out: phNewContext=0x28b3eec, pOutput=0x28b4320, pfContextAttr=0x28b2510, ptsExpiry=0x8fe778) returned 0x90312 [0168.969] recv (in: s=0x5a0, buf=0x28b43b0, len=5, flags=0 | out: buf=0x28b43b0*) returned 5 [0168.969] recv (in: s=0x5a0, buf=0x28b43c9, len=2335, flags=0 | out: buf=0x28b43c9*) returned 2335 [0168.969] InitializeSecurityContextW (in: phCredential=0x8fe6dc, phContext=0x8fe76c, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b4d58, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b4d6c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe6d4 | out: phNewContext=0x28b3eec, pOutput=0x28b4d6c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe6d4) returned 0x90312 [0169.018] recv (in: s=0x5a0, buf=0x28b4dfc, len=5, flags=0 | out: buf=0x28b4dfc*) returned 5 [0169.018] recv (in: s=0x5a0, buf=0x28b4e15, len=115, flags=0 | out: buf=0x28b4e15*) returned 115 [0169.018] InitializeSecurityContextW (in: phCredential=0x8fe638, phContext=0x8fe6c8, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b4ef8, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b4f0c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe630 | out: phNewContext=0x28b3eec, pOutput=0x28b4f0c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe630) returned 0x90312 [0169.019] recv (in: s=0x5a0, buf=0x28b4f9c, len=5, flags=0 | out: buf=0x28b4f9c*) returned 5 [0169.019] recv (in: s=0x5a0, buf=0x28b4fb5, len=4, flags=0 | out: buf=0x28b4fb5*) returned 4 [0169.019] InitializeSecurityContextW (in: phCredential=0x8fe594, phContext=0x8fe624, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b502c, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b5040, pfContextAttr=0x28b2510, ptsExpiry=0x8fe58c | out: phNewContext=0x28b3eec, pOutput=0x28b5040, pfContextAttr=0x28b2510, ptsExpiry=0x8fe58c) returned 0x90312 [0169.427] FreeContextBuffer (in: pvContextBuffer=0xa27730 | out: pvContextBuffer=0xa27730) returned 0x0 [0169.427] send (s=0x5a0, buf=0x28b50bc*, len=93, flags=0) returned 93 [0169.428] recv (in: s=0x5a0, buf=0x28b50bc, len=5, flags=0 | out: buf=0x28b50bc*) returned 5 [0169.442] recv (in: s=0x5a0, buf=0x28b5141, len=236, flags=0 | out: buf=0x28b5141*) returned 236 [0169.442] InitializeSecurityContextW (in: phCredential=0x8fe4f0, phContext=0x8fe580, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b52a0, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b52b4, pfContextAttr=0x28b2510, ptsExpiry=0x8fe4e8 | out: phNewContext=0x28b3eec, pOutput=0x28b52b4, pfContextAttr=0x28b2510, ptsExpiry=0x8fe4e8) returned 0x90312 [0169.442] recv (in: s=0x5a0, buf=0x28b5344, len=5, flags=0 | out: buf=0x28b5344*) returned 5 [0169.443] recv (in: s=0x5a0, buf=0x28b535d, len=1, flags=0 | out: buf=0x28b535d*) returned 1 [0169.443] InitializeSecurityContextW (in: phCredential=0x8fe44c, phContext=0x8fe4dc, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b53d0, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b53e4, pfContextAttr=0x28b2510, ptsExpiry=0x8fe444 | out: phNewContext=0x28b3eec, pOutput=0x28b53e4, pfContextAttr=0x28b2510, ptsExpiry=0x8fe444) returned 0x90312 [0169.443] recv (in: s=0x5a0, buf=0x28b5474, len=5, flags=0 | out: buf=0x28b5474*) returned 5 [0169.443] recv (in: s=0x5a0, buf=0x28b548d, len=40, flags=0 | out: buf=0x28b548d*) returned 40 [0169.443] InitializeSecurityContextW (in: phCredential=0x8fe3a8, phContext=0x8fe438, pTargetName=0x28a5550, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x28b5528, Reserved2=0x0, phNewContext=0x28b3eec, pOutput=0x28b553c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe3a0 | out: phNewContext=0x28b3eec, pOutput=0x28b553c, pfContextAttr=0x28b2510, ptsExpiry=0x8fe3a0) returned 0x0 [0169.656] QueryContextAttributesW (in: phContext=0x28b3eec, ulAttribute=0x4, pBuffer=0x28b55e8 | out: pBuffer=0x28b55e8) returned 0x0 [0169.657] QueryContextAttributesW (in: phContext=0x28b3eec, ulAttribute=0x5a, pBuffer=0x28b5640 | out: pBuffer=0x28b5640) returned 0x0 [0169.658] QueryContextAttributesW (in: phContext=0x28b3eec, ulAttribute=0x53, pBuffer=0x28b56ec | out: pBuffer=0x28b56ec) returned 0x0 [0169.701] CertDuplicateCertificateContext (pCertContext=0xa4a3c0) returned 0xa4a3c0 [0169.702] CertDuplicateStore (hCertStore=0xa27118) returned 0xa27118 [0169.703] CertEnumCertificatesInStore (hCertStore=0xa27118, pPrevCertContext=0x0) returned 0xa4a910 [0169.703] CertDuplicateCertificateContext (pCertContext=0xa4a910) returned 0xa4a910 [0169.703] CertEnumCertificatesInStore (hCertStore=0xa27118, pPrevCertContext=0xa4a910) returned 0xa4a3c0 [0169.703] CertDuplicateCertificateContext (pCertContext=0xa4a3c0) returned 0xa4a3c0 [0169.703] CertEnumCertificatesInStore (hCertStore=0xa27118, pPrevCertContext=0xa4a3c0) returned 0x0 [0169.703] CertCloseStore (hCertStore=0xa27118, dwFlags=0x0) returned 1 [0169.704] CertFreeCertificateContext (pCertContext=0xa4a3c0) returned 1 [0169.773] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0xa27730 [0169.778] CertAddCRLLinkToStore (in: hCertStore=0xa27730, pCrlContext=0xa4a910, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0169.786] CertAddCRLLinkToStore (in: hCertStore=0xa27730, pCrlContext=0xa4a3c0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0169.787] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0xa22e20 [0169.792] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0xa4a3c0, pTime=0x8fe3b8, hAdditionalStore=0xa27730, pChainPara=0x8fe2f8, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x8fe2ec | out: ppChainContext=0x8fe2ec) returned 1 [0169.861] LocalFree (hMem=0xa22e20) returned 0x0 [0169.861] CertDuplicateCertificateChain (pChainContext=0x7a80ff0) returned 0x7a80ff0 [0169.862] CertDuplicateCertificateContext (pCertContext=0xa4a3c0) returned 0xa4a3c0 [0169.862] CertDuplicateCertificateContext (pCertContext=0xa4a820) returned 0xa4a820 [0169.862] CertDuplicateCertificateContext (pCertContext=0xa4a6e0) returned 0xa4a6e0 [0169.862] CertFreeCertificateChain (pChainContext=0x7a80ff0) [0169.862] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x7a80ff0, pPolicyPara=0x8fe498, pPolicyStatus=0x8fe484 | out: pPolicyStatus=0x8fe484) returned 1 [0169.864] SetLastError (dwErrCode=0x0) [0169.866] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x7a80ff0, pPolicyPara=0x8fe4f8, pPolicyStatus=0x8fe4ac | out: pPolicyStatus=0x8fe4ac) returned 1 [0169.875] CertFreeCertificateChain (pChainContext=0x7a80ff0) [0169.875] CertFreeCertificateContext (pCertContext=0xa4a3c0) returned 1 [0169.879] CoTaskMemAlloc (cb=0x20c) returned 0x7a80ff0 [0169.879] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x7a80ff0, nSize=0x104 | out: lpBuffer="떨¥섘¤Ā") returned 0x0 [0169.879] CoTaskMemFree (pv=0x7a80ff0) [0169.879] CoTaskMemAlloc (cb=0x20c) returned 0x7a80ff0 [0169.879] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x7a80ff0, nSize=0x104 | out: lpBuffer="떨¥섘¤Ā") returned 0x0 [0169.879] CoTaskMemFree (pv=0x7a80ff0) [0169.879] CoTaskMemAlloc (cb=0x20c) returned 0x7a80ff0 [0169.879] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x7a80ff0, nSize=0x104 | out: lpBuffer="떨¥섘¤Ā") returned 0x0 [0169.879] CoTaskMemFree (pv=0x7a80ff0) [0169.879] CoTaskMemAlloc (cb=0x20c) returned 0x7a80ff0 [0169.879] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x7a80ff0, nSize=0x104 | out: lpBuffer="떨¥섘¤Ā") returned 0x0 [0169.880] CoTaskMemFree (pv=0x7a80ff0) [0169.881] EncryptMessage (in: phContext=0x28b3eec, fQOP=0x0, pMessage=0x28bd810, MessageSeqNo=0x0 | out: pMessage=0x28bd810) returned 0x0 [0169.881] send (s=0x5a0, buf=0x28bc2e8*, len=93, flags=0) returned 93 [0169.883] setsockopt (s=0x5a0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0169.884] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.934] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.935] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28cdbe0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28cdbe0, pfQOP=0x0) returned 0x0 [0169.954] setsockopt (s=0x5a0, level=65535, optname=4102, optval="ô\x01", optlen=4) returned 0 [0169.955] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed98 | out: lpPerformanceCount=0x8fed98*=26497367367) returned 1 [0169.955] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497375356) returned 1 [0169.959] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.959] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.959] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d17e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d17e0, pfQOP=0x0) returned 0x0 [0169.959] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497825360) returned 1 [0169.959] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.959] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.959] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1900, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1900, pfQOP=0x0) returned 0x0 [0169.960] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497859539) returned 1 [0169.960] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.960] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.960] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1a20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1a20, pfQOP=0x0) returned 0x0 [0169.960] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497891061) returned 1 [0169.960] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.960] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.960] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1b40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1b40, pfQOP=0x0) returned 0x0 [0169.960] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497922782) returned 1 [0169.960] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.960] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.960] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1c60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1c60, pfQOP=0x0) returned 0x0 [0169.960] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497954700) returned 1 [0169.961] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.961] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.961] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1d80, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1d80, pfQOP=0x0) returned 0x0 [0169.961] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26497986733) returned 1 [0169.961] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.961] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.961] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1ea0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1ea0, pfQOP=0x0) returned 0x0 [0169.961] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498018208) returned 1 [0169.961] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.961] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.961] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d1fc0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d1fc0, pfQOP=0x0) returned 0x0 [0169.961] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498049145) returned 1 [0169.962] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.962] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.962] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d20e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d20e0, pfQOP=0x0) returned 0x0 [0169.962] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498081323) returned 1 [0169.962] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.962] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.962] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2200, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2200, pfQOP=0x0) returned 0x0 [0169.962] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498114538) returned 1 [0169.962] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.962] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.962] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2320, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2320, pfQOP=0x0) returned 0x0 [0169.963] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498159944) returned 1 [0169.963] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.963] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.963] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2440, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2440, pfQOP=0x0) returned 0x0 [0169.963] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498191808) returned 1 [0169.963] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.963] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.963] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2560, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2560, pfQOP=0x0) returned 0x0 [0169.963] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498223106) returned 1 [0169.963] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.963] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.963] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2680, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2680, pfQOP=0x0) returned 0x0 [0169.964] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498256920) returned 1 [0169.964] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.964] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.964] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d27a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d27a0, pfQOP=0x0) returned 0x0 [0169.964] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498289332) returned 1 [0169.964] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.964] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.964] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d28c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d28c0, pfQOP=0x0) returned 0x0 [0169.964] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498330059) returned 1 [0169.964] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.964] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.964] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d29e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d29e0, pfQOP=0x0) returned 0x0 [0169.965] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498361516) returned 1 [0169.965] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.965] recv (in: s=0x5a0, buf=0x28c9b25, len=1117, flags=0 | out: buf=0x28c9b25*) returned 1117 [0169.965] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2b00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2b00, pfQOP=0x0) returned 0x0 [0169.965] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498402869) returned 1 [0169.965] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.965] recv (in: s=0x5a0, buf=0x28c9b25, len=264, flags=0 | out: buf=0x28c9b25*) returned 264 [0169.965] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2c20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2c20, pfQOP=0x0) returned 0x0 [0169.966] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498459631) returned 1 [0169.966] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.966] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.966] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2d40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2d40, pfQOP=0x0) returned 0x0 [0169.966] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498497693) returned 1 [0169.966] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.966] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.966] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2e60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2e60, pfQOP=0x0) returned 0x0 [0169.966] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498529972) returned 1 [0169.966] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.966] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.966] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d2f80, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d2f80, pfQOP=0x0) returned 0x0 [0169.967] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498561332) returned 1 [0169.967] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.967] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.967] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d30a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d30a0, pfQOP=0x0) returned 0x0 [0169.967] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498594872) returned 1 [0169.967] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.967] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.967] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d31c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d31c0, pfQOP=0x0) returned 0x0 [0169.967] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498627031) returned 1 [0169.967] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.967] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.967] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d32e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d32e0, pfQOP=0x0) returned 0x0 [0169.968] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498661307) returned 1 [0169.968] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.968] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.968] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3400, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3400, pfQOP=0x0) returned 0x0 [0169.968] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498694395) returned 1 [0169.968] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.968] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.968] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3520, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3520, pfQOP=0x0) returned 0x0 [0169.968] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498728021) returned 1 [0169.968] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.968] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.968] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3640, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3640, pfQOP=0x0) returned 0x0 [0169.969] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498759566) returned 1 [0169.969] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.969] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.969] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3760, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3760, pfQOP=0x0) returned 0x0 [0169.969] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498790458) returned 1 [0169.969] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.969] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.969] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3880, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3880, pfQOP=0x0) returned 0x0 [0169.969] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498821456) returned 1 [0169.969] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.969] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.969] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d39a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d39a0, pfQOP=0x0) returned 0x0 [0169.969] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498851497) returned 1 [0169.970] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.970] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.970] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3ac0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3ac0, pfQOP=0x0) returned 0x0 [0169.970] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498881195) returned 1 [0169.970] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.970] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.970] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3be0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3be0, pfQOP=0x0) returned 0x0 [0169.970] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498910919) returned 1 [0169.970] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.970] recv (in: s=0x5a0, buf=0x28c9b25, len=1425, flags=0 | out: buf=0x28c9b25*) returned 1425 [0169.970] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3d00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3d00, pfQOP=0x0) returned 0x0 [0169.970] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498942647) returned 1 [0169.970] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.971] recv (in: s=0x5a0, buf=0x28c9b25, len=226, flags=0 | out: buf=0x28c9b25*) returned 226 [0169.971] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3e20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3e20, pfQOP=0x0) returned 0x0 [0169.971] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed60 | out: lpPerformanceCount=0x8fed60*=26498973372) returned 1 [0169.971] recv (in: s=0x5a0, buf=0x28c9b20, len=5, flags=0 | out: buf=0x28c9b20*) returned 5 [0169.971] recv (in: s=0x5a0, buf=0x28c9b25, len=29, flags=0 | out: buf=0x28c9b25*) returned 29 [0169.971] DecryptMessage (in: phContext=0x28b3eec, pMessage=0x28d3f40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x28d3f40, pfQOP=0x0) returned 0x0 [0169.971] SetEvent (hEvent=0x2d0) returned 1 [0169.971] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed84 | out: lpPerformanceCount=0x8fed84*=26499029248) returned 1 [0169.982] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ransom.jpg", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x15 [0169.982] GetFullPathNameW (in: lpFileName="C:\\FD1HVy\\ransom.jpg", nBufferLength=0x15, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\FD1HVy\\ransom.jpg", lpFilePart=0x0) returned 0x14 [0169.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8fed2c) returned 1 [0169.982] CreateFileW (lpFileName="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6a4 [0169.984] GetFileType (hFile=0x6a4) returned 0x1 [0169.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8fed28) returned 1 [0169.984] GetFileType (hFile=0x6a4) returned 0x1 [0169.985] QueryPerformanceCounter (in: lpPerformanceCount=0x8fedb0 | out: lpPerformanceCount=0x8fedb0*=26500370249) returned 1 [0169.985] SetEvent (hEvent=0x2d0) returned 1 [0169.985] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb8*=0x4a0, lpdwindex=0x8fe9d4 | out: lpdwindex=0x8fe9d4) returned 0x80010115 [0169.986] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8feb98*=0x490, lpdwindex=0x8fe9b4 | out: lpdwindex=0x8fe9b4) returned 0x80010115 [0169.987] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8feb98*=0x498, lpdwindex=0x8fe9b4 | out: lpdwindex=0x8fe9b4) returned 0x80010115 [0169.987] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febec*=0x4c0, lpdwindex=0x8fea0c | out: lpdwindex=0x8fea0c) returned 0x80010115 [0169.988] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febec*=0x4c8, lpdwindex=0x8fea0c | out: lpdwindex=0x8fea0c) returned 0x80010115 [0169.988] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febec*=0x4d0, lpdwindex=0x8fea0c | out: lpdwindex=0x8fea0c) returned 0x80010115 [0169.989] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6ac [0169.990] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6b0 [0169.990] GetAddrInfoW (in: pNodeName="wannadie.altervista.org", pServiceName=0x0, pHints=0x8feaec*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x8fea94 | out: ppResult=0x8fea94*=0xa48a48*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="wannadie.altervista.org", ai_addr=0xa50ef8*(sa_family=2, sin_port=0x0, sin_addr="51.75.240.53"), ai_next=0x0)) returned 0 [0170.095] FreeAddrInfoW (pAddrInfo=0xa48a48*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="wannadie.altervista.org", ai_addr=0xa50ef8*(sa_family=2, sin_port=0x0, sin_addr="51.75.240.53"), ai_next=0x0)) [0170.095] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8fea30*=0x5b4, lpdwindex=0x8fe84c | out: lpdwindex=0x8fe84c) returned 0x80010115 [0170.096] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8fea30*=0x5bc, lpdwindex=0x8fe84c | out: lpdwindex=0x8fe84c) returned 0x80010115 [0170.096] WSAConnect (in: s=0x6ac, name=0x28e6008*(sa_family=2, sin_port=0x50, sin_addr="51.75.240.53"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0170.127] closesocket (s=0x6b0) returned 0 [0170.127] send (s=0x6ac, buf=0x28a632c*, len=82, flags=0) returned 82 [0170.128] setsockopt (s=0x6ac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0170.128] recv (in: s=0x6ac, buf=0x28a0a18, len=4096, flags=0 | out: buf=0x28a0a18*) returned 4096 [0170.163] setsockopt (s=0x6ac, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0170.164] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 10504 [0170.164] WriteFile (in: hFile=0x6a4, lpBuffer=0x28f6a7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28f6a7c*, lpNumberOfBytesWritten=0x8fed70*=0x1000, lpOverlapped=0x0) returned 1 [0170.166] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6bab*, nNumberOfBytesToWrite=0x27a9, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6bab*, lpNumberOfBytesWritten=0x8fed70*=0x27a9, lpOverlapped=0x0) returned 1 [0170.166] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 65536 [0170.222] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x10000, lpOverlapped=0x0) returned 1 [0170.224] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 22064 [0170.224] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x5630, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x5630, lpOverlapped=0x0) returned 1 [0170.224] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 2920 [0170.246] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 61320 [0170.246] WriteFile (in: hFile=0x6a4, lpBuffer=0x28f6a7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28f6a7c*, lpNumberOfBytesWritten=0x8fed70*=0x1000, lpOverlapped=0x0) returned 1 [0170.247] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6ee4*, nNumberOfBytesToWrite=0xeaf0, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6ee4*, lpNumberOfBytesWritten=0x8fed70*=0xeaf0, lpOverlapped=0x0) returned 1 [0170.248] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 35040 [0170.307] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x88e0, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x88e0, lpOverlapped=0x0) returned 1 [0170.308] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 65536 [0170.309] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x10000, lpOverlapped=0x0) returned 1 [0170.311] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 22064 [0170.311] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x5630, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x5630, lpOverlapped=0x0) returned 1 [0170.312] recv (in: s=0x6ac, buf=0x28e6a4c, len=65536, flags=0 | out: buf=0x28e6a4c*) returned 40880 [0170.320] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0x9fb0, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0x9fb0, lpOverlapped=0x0) returned 1 [0170.321] recv (in: s=0x6ac, buf=0x28e6a4c, len=47309, flags=0 | out: buf=0x28e6a4c*) returned 47309 [0170.341] WriteFile (in: hFile=0x6a4, lpBuffer=0x28e6a4c*, nNumberOfBytesToWrite=0xb8cd, lpNumberOfBytesWritten=0x8fed70, lpOverlapped=0x0 | out: lpBuffer=0x28e6a4c*, lpNumberOfBytesWritten=0x8fed70*=0xb8cd, lpOverlapped=0x0) returned 1 [0170.343] CloseHandle (hObject=0x6a4) returned 1 [0170.369] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\FD1HVy\\ransom.jpg" (normalized: "c:\\fd1hvy\\ransom.jpg"), fWinIni=0x3 | out: pvParam=0x2889424) returned 1 [0170.803] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x1a, wParam=0x14, lParam=0x59cf58) returned 0x0 [0170.803] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x1a, wParam=0x14, lParam=0x59cf58) returned 0x0 [0170.805] SystemParametersInfoW (in: uiAction=0x26, uiParam=0x0, pvParam=0x8fe998, fWinIni=0x0 | out: pvParam=0x8fe998) returned 1 [0170.807] LocalAlloc (uFlags=0x0, uBytes=0x2) returned 0x9d8980 [0170.807] PostMessageW (hWnd=0x50050, Msg=0x201a, wParam=0x14, lParam=0x9d8980) returned 1 [0170.808] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x1a, wParam=0x14, lParam=0x59cf58) returned 0x0 [0172.252] QueryPerformanceCounter (in: lpPerformanceCount=0x8fed74 | out: lpPerformanceCount=0x8fed74*=26727108178) returned 1 [0172.252] SetEvent (hEvent=0x2d0) returned 1 [0172.252] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8feb7c*=0x4a0, lpdwindex=0x8fe99c | out: lpdwindex=0x8fe99c) returned 0x80010115 [0172.253] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8feb5c*=0x490, lpdwindex=0x8fe97c | out: lpdwindex=0x8fe97c) returned 0x80010115 [0172.254] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8feb5c*=0x498, lpdwindex=0x8fe97c | out: lpdwindex=0x8fe97c) returned 0x80010115 [0172.254] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb0*=0x4c0, lpdwindex=0x8fe9cc | out: lpdwindex=0x8fe9cc) returned 0x80010115 [0172.255] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb0*=0x4c8, lpdwindex=0x8fe9cc | out: lpdwindex=0x8fe9cc) returned 0x80010115 [0172.255] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x8febb0*=0x4d0, lpdwindex=0x8fe9cc | out: lpdwindex=0x8fe9cc) returned 0x80010115 [0172.256] select (in: nfds=0, readfds=0x28f8944, writefds=0x0, exceptfds=0x0, timeout=0x8fec48*(tv_sec=0, tv_usec=0) | out: readfds=0x28f8944, writefds=0x0, exceptfds=0x0) returned 1 [0172.258] shutdown (s=0x6ac, how=2) returned 0 [0172.259] setsockopt (s=0x6ac, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0172.259] closesocket (s=0x6ac) returned 0 [0172.260] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6ac [0172.260] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6a4 [0172.260] WSAConnect (in: s=0x6ac, name=0x28f8d94*(sa_family=2, sin_port=0x50, sin_addr="51.75.240.53"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0172.298] closesocket (s=0x6a4) returned 0 [0172.299] send (s=0x6ac, buf=0x28a632c*, len=133, flags=0) returned 133 [0172.299] setsockopt (s=0x6ac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0172.299] recv (in: s=0x6ac, buf=0x28a0a18, len=4096, flags=0 | out: buf=0x28a0a18*) returned 191 [0177.404] setsockopt (s=0x6ac, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0177.405] recv (in: s=0x6ac, buf=0x28a0a18, len=12, flags=0 | out: buf=0x28a0a18*) returned 5 [0177.431] InvalidateRect (hWnd=0x7002e, lpRect=0x0, bErase=1) returned 1 [0177.432] GetWindowThreadProcessId (in: hWnd=0x8005c, lpdwProcessId=0x8fee80 | out: lpdwProcessId=0x8fee80) returned 0xd1c [0177.432] GetCurrentThreadId () returned 0xd1c [0177.432] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc19e [0177.433] PostMessageW (hWnd=0x8005c, Msg=0xc19e, wParam=0x0, lParam=0x0) returned 1 [0177.433] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0177.434] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0177.434] GetSystemMetrics (nIndex=42) returned 0 [0177.434] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fedfc, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0177.434] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fedfc) returned 0x7 [0177.445] OleInitialize (pvReserved=0x0) returned 0x0 [0177.447] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x8ff3ac | out: lplpMessageFilter=0x8ff3ac*=0x0) returned 0x0 [0177.448] PeekMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.448] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0177.449] IsWindowUnicode (hWnd=0x8005c) returned 1 [0177.450] GetMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.450] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0177.451] TranslateMessage (lpMsg=0x8ff380) returned 0 [0177.452] DispatchMessageW (lpMsg=0x8ff380) returned 0x0 [0177.452] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x46, wParam=0x0, lParam=0x8ff0d4) returned 0x0 [0177.453] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x1, lParam=0x8ff0ac) returned 0x0 [0177.468] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x85, wParam=0x930405d8, lParam=0x0) returned 0x0 [0177.470] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fee1c | out: lpwndpl=0x8fee1c) returned 1 [0177.471] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fedc8 | out: lpRect=0x8fedc8) returned 1 [0177.471] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0177.471] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0177.471] GetSystemMetrics (nIndex=42) returned 0 [0177.471] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fec90, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0177.471] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fec90) returned 0x7 [0177.471] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fecd0 | out: lpRect=0x8fecd0) returned 1 [0177.471] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0177.471] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0177.471] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x290506b6 [0177.471] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0177.471] SaveDC (hdc=0x60100ce) returned 1 [0177.472] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0177.472] CreateSolidBrush (color=0xf0f0f0) returned 0x1d1007c0 [0177.472] FillRect (hDC=0x60100ce, lprc=0x8feb70, hbr=0x1d1007c0) returned 1 [0177.472] DeleteObject (ho=0x1d1007c0) returned 1 [0177.472] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0177.473] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fee00 | out: lpwndpl=0x8fee00) returned 1 [0177.473] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x47, wParam=0x0, lParam=0x8ff0d4) returned 0x0 [0177.473] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fedb0 | out: lpRect=0x8fedb0) returned 1 [0177.473] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fedb0 | out: lpRect=0x8fedb0) returned 1 [0177.475] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x83, wParam=0x1, lParam=0x8febec) returned 0x0 [0177.481] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x85, wParam=0x970405d8, lParam=0x0) returned 0x0 [0177.482] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fe95c | out: lpwndpl=0x8fe95c) returned 1 [0177.482] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe908 | out: lpRect=0x8fe908) returned 1 [0177.482] GetWindowTextLengthW (hWnd=0x8005c) returned 7 [0177.482] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0177.482] GetSystemMetrics (nIndex=42) returned 0 [0177.482] GetWindowTextW (in: hWnd=0x8005c, lpString=0x8fe7d0, nMaxCount=8 | out: lpString="CRACKED") returned 7 [0177.483] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0xd, wParam=0x8, lParam=0x8fe7d0) returned 0x7 [0177.483] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fe810 | out: lpRect=0x8fe810) returned 1 [0177.483] GetCurrentObject (hdc=0x60100ce, type=0x1) returned 0xb00017 [0177.483] GetCurrentObject (hdc=0x60100ce, type=0x2) returned 0x900010 [0177.483] GetCurrentObject (hdc=0x60100ce, type=0x7) returned 0x290506b6 [0177.483] GetCurrentObject (hdc=0x60100ce, type=0x6) returned 0x8a01c2 [0177.483] SaveDC (hdc=0x60100ce) returned 1 [0177.483] GetNearestColor (hdc=0x60100ce, color=0xf0f0f0) returned 0xf0f0f0 [0177.483] CreateSolidBrush (color=0xf0f0f0) returned 0x1e1007c0 [0177.483] FillRect (hDC=0x60100ce, lprc=0x8fe6b0, hbr=0x1e1007c0) returned 1 [0177.483] DeleteObject (ho=0x1e1007c0) returned 1 [0177.483] RestoreDC (hdc=0x60100ce, nSavedDC=-1) returned 1 [0177.484] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0177.484] PeekMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.484] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0177.485] IsWindowUnicode (hWnd=0x302b0) returned 1 [0177.485] GetMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.610] TranslateMessage (lpMsg=0x8ff380) returned 0 [0177.610] DispatchMessageW (lpMsg=0x8ff380) returned 0x0 [0177.610] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0177.610] PeekMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.610] IsWindowUnicode (hWnd=0x50050) returned 1 [0177.610] GetMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.610] TranslateMessage (lpMsg=0x8ff380) returned 0 [0177.610] DispatchMessageW (lpMsg=0x8ff380) returned 0x0 [0177.906] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0177.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0177.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.907] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0177.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x8feeb4) returned 1 [0177.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\compito italiano.doc.exe"), fInfoLevelId=0x0, lpFileInformation=0x8fef30 | out: lpFileInformation=0x8fef30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0177.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x8feeb0) returned 1 [0177.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0177.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0177.915] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", nBufferLength=0x31, lpBuffer=0x9d8e28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop\\compito italiano.doc.exe", lpFilePart=0x0) returned 0x30 [0177.930] GetWindowThreadProcessId (in: hWnd=0x302c2, lpdwProcessId=0x8fefac | out: lpdwProcessId=0x8fefac) returned 0xd1c [0177.930] GetCurrentThreadId () returned 0xd1c [0177.941] GetWindowThreadProcessId (in: hWnd=0x302c2, lpdwProcessId=0x8fefac | out: lpdwProcessId=0x8fefac) returned 0xd1c [0177.941] GetCurrentThreadId () returned 0xd1c [0177.941] LocalFree (hMem=0x9d8980) returned 0x0 [0177.941] NtdllDefWindowProc_W (hWnd=0x50050, Msg=0x201a, wParam=0x14, lParam=0x9d8980) returned 0x0 [0177.941] PeekMessageW (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x8ff380) returned 1 [0177.942] GetMessageA (in: lpMsg=0x8ff380, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x8ff380) returned 0 [0178.035] DestroyCursor (hCursor=0x12a029b) returned 1 [0178.039] GetWindowLongW (hWnd=0x8005c, nIndex=-20) returned 590208 [0178.039] DestroyWindow (hWnd=0x8005c) returned 1 [0178.039] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0178.040] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x46, wParam=0x0, lParam=0x8ff12c) returned 0x0 [0178.044] GetWindowPlacement (in: hWnd=0x8005c, lpwndpl=0x8fee58 | out: lpwndpl=0x8fee58) returned 1 [0178.044] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x47, wParam=0x0, lParam=0x8ff12c) returned 0x0 [0178.044] GetClientRect (in: hWnd=0x8005c, lpRect=0x8fee08 | out: lpRect=0x8fee08) returned 1 [0178.045] GetWindowRect (in: hWnd=0x8005c, lpRect=0x8fee08 | out: lpRect=0x8fee08) returned 1 [0178.045] PostThreadMessageW (idThread=0xd1c, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0178.045] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0178.046] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0178.046] CallWindowProcW (lpPrevWndFunc=0x6fbaabc0, hWnd=0x7002e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0178.048] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x8005c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0178.048] DestroyWindow (hWnd=0x302b0) returned 1 [0178.048] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0178.048] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0178.049] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x302b0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0178.062] GetCurrentThreadId () returned 0xd1c [0178.062] EnumThreadWindows (dwThreadId=0xd1c, lpfn=0x4d4394e, lParam=0x0) returned 1 [0178.066] IsWindowVisible (hWnd=0x50050) returned 0 [0178.082] IsWindowVisible (hWnd=0x602ac) returned 0 [0178.082] GetWindowThreadProcessId (in: hWnd=0x70036, lpdwProcessId=0x8ff30c | out: lpdwProcessId=0x8ff30c) returned 0xd1c [0178.082] GetCurrentThreadId () returned 0xd1c [0178.091] GetWindowLongW (hWnd=0x70036, nIndex=-20) returned 65792 [0178.091] DestroyWindow (hWnd=0x70036) returned 1 [0178.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0178.092] GetWindowTextLengthW (hWnd=0x70036) returned 25 [0178.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0178.092] GetSystemMetrics (nIndex=42) returned 0 [0178.092] GetWindowTextW (in: hWnd=0x70036, lpString=0x8fedb0, nMaxCount=26 | out: lpString="WindowsFormsParkingWindow") returned 25 [0178.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0xd, wParam=0x1a, lParam=0x8fedb0) returned 0x19 [0178.092] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0178.129] CallWindowProcW (lpPrevWndFunc=0x743c0140, hWnd=0x70036, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0178.130] GetCurrentThreadId () returned 0xd1c [0178.131] GetCurrentThreadId () returned 0xd1c [0178.131] EnumThreadWindows (dwThreadId=0xd1c, lpfn=0x4d43b2e, lParam=0x0) returned 1 [0178.132] IsWindowVisible (hWnd=0x50050) returned 0 [0178.132] IsWindowVisible (hWnd=0x602ac) returned 0 [0178.134] OleUninitialize () [0178.135] CloseHandle (hObject=0x2f8) returned 1 [0178.135] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ec90002) returned 1 [0178.136] CoGetContextToken (in: pToken=0x8ffd28 | out: pToken=0x8ffd28) returned 0x0 [0178.136] CObjectContext::QueryInterface () returned 0x0 [0178.137] CObjectContext::GetCurrentThreadType () returned 0x0 [0178.137] Release () returned 0x0 [0178.138] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x99bda0*=0x198, lpdwindex=0x8ffbcc | out: lpdwindex=0x8ffbcc) returned 0x0 Thread: id = 2 os_tid = 0x10fc Thread: id = 3 os_tid = 0x300 Thread: id = 4 os_tid = 0xf04 [0084.646] CoGetContextToken (in: pToken=0x488fa74 | out: pToken=0x488fa74) returned 0x800401f0 [0084.646] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0084.647] RoInitialize () returned 0x1 [0084.647] RoUninitialize () returned 0x0 [0117.130] CloseHandle (hObject=0x2dc) returned 1 [0117.131] CloseHandle (hObject=0x2d8) returned 1 [0117.131] CloseHandle (hObject=0x2f0) returned 1 [0117.131] CloseHandle (hObject=0x2d4) returned 1 [0117.131] CloseHandle (hObject=0x2d0) returned 1 [0117.131] CloseHandle (hObject=0x2ec) returned 1 [0117.132] CloseHandle (hObject=0x2e8) returned 1 [0117.132] CloseHandle (hObject=0x2cc) returned 1 [0117.132] CloseHandle (hObject=0x2e4) returned 1 [0117.132] CloseHandle (hObject=0x2e0) returned 1 [0178.229] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=1950089536) returned 81004046 [0178.231] SetClassLongW (hWnd=0x302c2, nIndex=-24, dwNewLong=1950089536) returned 0x4d405e6 [0178.231] PostMessageW (hWnd=0x302c2, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0178.232] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0178.232] UnregisterClassW (lpClassName="WindowsForms10.Window.0.app.0.141b42a_r9_ad1", hInstance=0x4f0000) returned 1 [0178.233] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0178.233] UnregisterClassW (lpClassName="WindowsForms10.STATIC.app.0.141b42a_r9_ad1", hInstance=0x4f0000) returned 1 [0178.234] GetModuleHandleW (lpModuleName=0x0) returned 0x4f0000 [0178.234] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r9_ad1", hInstance=0x4f0000) returned 0 [0178.237] IsWindow (hWnd=0x50050) returned 1 [0178.237] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0178.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x488f814, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcWâq'û\x0eãðù°s\x98ú\x88\x04\x01", lpUsedDefaultChar=0x0) returned 14 [0178.239] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x743c0140 [0178.239] SetWindowLongW (hWnd=0x50050, nIndex=-4, dwNewLong=1950089536) returned 81004126 [0178.240] SetClassLongW (hWnd=0x50050, nIndex=-24, dwNewLong=1950089536) returned 0x4d4065e [0178.240] IsWindow (hWnd=0x50050) returned 1 [0178.240] DestroyWindow (hWnd=0x50050) returned 0 [0178.240] PostMessageW (hWnd=0x50050, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0178.240] SetConsoleCtrlHandler (HandlerRoutine=0x4d40636, Add=0) returned 1 [0178.241] EtwEventUnregister (RegHandle=0xa04c80) returned 0x0 [0178.241] EtwEventUnregister (RegHandle=0xa056a0) returned 0x0 [0178.241] DeleteObject (ho=0x47080787) returned 1 [0178.271] DestroyCursor (hCursor=0x8020d) returned 1 [0178.273] DeleteObject (ho=0x2e0a051e) returned 1 [0178.274] RestoreDC (hdc=0x901078f, nSavedDC=-1) returned 1 [0178.275] DeleteDC (hdc=0x901078f) returned 1 [0178.275] DeleteObject (ho=0x390a07b4) returned 1 [0178.275] GdipDeleteFont (font=0x5ffa998) returned 0x0 [0178.276] GdipDeleteFont (font=0x4ee04c0) returned 0x0 [0178.279] setsockopt (s=0x5b8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0178.280] closesocket (s=0x5b8) returned 0 [0178.281] CloseHandle (hObject=0x5bc) returned 1 [0178.281] setsockopt (s=0x5a8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0178.282] closesocket (s=0x5a8) returned 0 [0178.282] CloseHandle (hObject=0x5b4) returned 1 [0178.283] setsockopt (s=0x5a0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0178.283] closesocket (s=0x5a0) returned 0 [0178.287] CertFreeCertificateContext (pCertContext=0xa4a6e0) returned 1 [0178.288] CloseHandle (hObject=0x55c) returned 1 [0178.288] CloseHandle (hObject=0x558) returned 1 [0178.288] CloseHandle (hObject=0x51c) returned 1 [0178.289] CloseHandle (hObject=0x518) returned 1 [0178.289] CertFreeCertificateContext (pCertContext=0xa4a820) returned 1 [0178.290] CertFreeCertificateContext (pCertContext=0xa4a3c0) returned 1 [0178.291] WinHttpCloseHandle (hInternet=0xa23fb8) returned 1 [0178.293] CloseHandle (hObject=0x4d4) returned 1 [0178.294] CloseHandle (hObject=0x4d0) returned 1 [0178.294] RegCloseKey (hKey=0x4cc) returned 0x0 [0178.294] CloseHandle (hObject=0x4c8) returned 1 [0178.295] RegCloseKey (hKey=0x4c4) returned 0x0 [0178.295] CloseHandle (hObject=0x4c0) returned 1 [0178.295] RegCloseKey (hKey=0x4bc) returned 0x0 [0178.296] RegCloseKey (hKey=0x4b8) returned 0x0 [0178.296] CloseHandle (hObject=0x4a0) returned 1 [0178.297] setsockopt (s=0x494, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0178.297] closesocket (s=0x494) returned 0 [0178.297] CloseHandle (hObject=0x498) returned 1 [0178.298] setsockopt (s=0x48c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0178.298] closesocket (s=0x48c) returned 0 [0178.299] CloseHandle (hObject=0x490) returned 1 [0178.299] CloseHandle (hObject=0x424) returned 1 [0178.299] CloseHandle (hObject=0x420) returned 1 [0178.300] CloseHandle (hObject=0x41c) returned 1 [0178.300] CloseHandle (hObject=0x40c) returned 1 [0178.301] CloseHandle (hObject=0x2dc) returned 1 [0178.301] CloseHandle (hObject=0x2d8) returned 1 [0178.301] CloseHandle (hObject=0x2f0) returned 1 [0178.302] CloseHandle (hObject=0x2ec) returned 1 [0178.303] CloseHandle (hObject=0x2e8) returned 1 [0178.303] CertCloseStore (hCertStore=0xa27730, dwFlags=0x0) returned 1 [0178.303] CloseHandle (hObject=0x2cc) returned 1 [0178.304] UnmapViewOfFile (lpBaseAddress=0x7b30000) returned 1 [0178.304] CertFreeCertificateContext (pCertContext=0xa4a3c0) returned 1 [0178.312] CertFreeCertificateContext (pCertContext=0xa4a910) returned 1 [0178.321] FreeCredentialsHandle (phCredential=0x28b3ce8) returned 0x0 [0178.322] DeleteSecurityContext (phContext=0x28b3eec) returned 0x0 [0178.324] CloseHandle (hObject=0x5c8) returned 1 [0178.325] RegCloseKey (hKey=0x80000004) returned 0x0 [0178.325] setsockopt (s=0x6ac, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0178.326] closesocket (s=0x6ac) returned 0 [0178.329] LocalFree (hMem=0x9d8e28) returned 0x0 [0178.333] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 5 os_tid = 0x1184 Thread: id = 6 os_tid = 0x1218 Thread: id = 7 os_tid = 0xe6c Thread: id = 8 os_tid = 0xbb0 Thread: id = 9 os_tid = 0x888 Thread: id = 10 os_tid = 0xc1c [0164.260] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0164.261] RoInitialize () returned 0x1 [0164.261] RoUninitialize () returned 0x0 [0164.264] ResetEvent (hEvent=0x2d0) returned 1 Thread: id = 11 os_tid = 0x58c Thread: id = 12 os_tid = 0xdec Thread: id = 13 os_tid = 0xc18 [0178.335] SleepEx (dwMilliseconds=0x14, bAlertable=0)